Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Receiving Health Check Events Related to the EDR Sensor

App Control: Receiving Health Check Events Related to the EDR Sensor

Environment

  • App Control Server: All Supported Versions
  • EDR Sensor: All Supported Versions

Symptoms

Seeing Health Check Events in App Control Console related to EDR sensors not functioning
Carbon Black App Control Agent detected a problem: EDR healthcheck failed. Carbon Black Sensor (CarbonBlack) is not running.
Carbon Black App Control Agent detected a problem: Neither cbstream.sys or cbtdiflt.sys are loaded.

Cause

This happens when the agent detects an EDR sensor and the sensor isn't functioning normally

Resolution

  • If the EDR sensor is supposed to be installed fix the issue stated in the event
  • If the EDR sensor is not being used then it may need to be uninstalled via uninst.exe or have remnants of an old sensor removed

Additional Notes

The health check can be configured to be ignored but fixing the actual cause of the event would be recommended

Related Content


Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎12-05-2023
Views:
133
Contributors