Seeing Alerts But Not All Associated Events in Azure Blob / AWS S3 Bucket

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Data Forwarder is configured
• Only seeing alerts in the Azure Blob or AWS S3 Bucket
• Wanting to see all events associated with the alert

Environment

• Carbon Black Cloud
• AWS S3 Bucket
• Azure Bob Storage

Cause

Alert Data Forwarder is configured, but not a Endpoint Event Data Forwarder

Resolution

Alerts and events both require their own data forwarder. To get all endpoint activity, Add a Data Forwarder for the Endpoint Event Data.

Additional Information

Data Forwarder Schema