Carbon Black Cloud: Does the Sensor Need the "Filtering Platform Connection" Events in the Windows Security Event Log?

[#1]

Environment

• Carbon Black Cloud Windows Sensor: All Supported Versions

Question

Does disabling auditing for WFP affect the sensor?

Answer

While the WFP Network Driver is needed the sensor doesn't require auditing for WFP to be enabled

Related Content

Auditing - Win32 apps