Carbon Black Cloud: How to Review Blocking Events in Windows Event Viewer (3.0 and above)

[#1]

Environment

• Carbon Black Cloud Windows Sensor: 3.0 and above
• Windows OS: All Supported Versions

Objective

Introuduce how to check CBC blocking events in Windows Event Viewer

Resolution

1. Open Event Viewer
2. Go to Windows Logs -> Application
3. Search for "CbDefense" or "Carbon Black", and you will see blocking events from CBC.

OR

1. Open Event Viewer
2. Go to Windows Logs -> Application
3. Under "Actions" menu select "Filter Current Log..."
4. In the Event Sources drop down select "CbDefense" to view only Cb Defense Events

Additional Notes

Search "CbDefense" in Event View can also give you CBC related events like service start, service stop, background scan, etc.

Related Content

CB Defense: Notifications Not Shown in Local Sensor UI
Endpoint Standard: How To Check Background Scan Status Via Event Viewer (Windows)
Carbon Black Cloud: How To Find Blocks In Windows Event Viewer (3.0 and below)