- Carbon Black Response Server: All Versions
- Carbon Black Event Forwarder: All Versions
Why do Procend or Procstarts still send from cb-event-forwarder when disabled?
When Procend or Procstart is disabled in the cb-event-forwarder the disabled both events will still send. These event use the alias "process" at the ingress of the events.