Environment
- EDR Server: All Versions
- Microsoft Windows: All Supported Versions
Question
What are the Windows sensor health score events and what is the impact on sensor health?
Answer
Event Load
|
Event Queue Depth
|
Health Score
|
Message
|
|
> 512
|
-5
|
Elevated event load
|
|
> 1024
|
-10
|
High event load
|
|
> 4096
|
-25
|
Excessive event load
|
Event Loss
|
Event Loss (%)
|
Health Score
|
Message
|
|
1
|
-5
|
Elevated event loss
|
|
2
|
-10
|
High event loss
|
|
5
|
-20
|
Very High event loss
|
|
10
|
-50
|
Excessive event loss
|
Disk Space
|
Disk Space (MB)
|
Health Score
|
Message
|
|
< 1024
|
-5
|
Low disk space
|
|
< 100
|
-25
|
Very Low disk space
|
|
< 10
|
-50
|
Excessively low disk space
|
Handle Count
|
Handles
|
Health Score
|
Message
|
|
> 500
|
-5
|
Elevated handle count
|
|
> 1000
|
-10
|
High handle count
|
|
> 2000
|
-25
|
Very high handle count
|
|
> 4000
|
-50
|
Excessive handle count
|
GDI Handle Count
|
GDI Handles
|
Health Scores
|
Message
|
|
> 100
|
-5
|
Excessive GDI HANDLE count
|
|
> 500
|
-10
|
Very High GDI HANDLE count
|
|
> 1000
|
-20
|
High GDI HANDLE count
|
Memory Usage
Memory (MB)
|
Health Score
|
Message
|
> 50
|
-5
|
Elevated memory usage
|
> 100
|
-10
|
Elevated memory usage
|
> 200
|
-20
|
High memory usage
|
> 512
|
-25
|
Very high memory usage
|
> 1024
|
-50
|
Excessive memory usage
|
Driver and Component Failures
|
Driver Failure
|
Health Score
|
Message
|
|
Svc Component
|
-25
|
Svc Component Failure
|
|
Netmon Driver
|
-25
|
NetMon Stream Driver Failure
|
|
Core Driver
|
-100
|
Core Driver Failure
|
Additional Notes
Remediation options can be found in the
User Guide.
Related Content
