Carbon Black Cloud: What are the scripts in the IR folder used for?

[#1]

Environment

• Endpoint Standard Sensor: 3.1.x - 3.5.x
• Enterprise EDR Sensor: 3.3.x - 3.5.x

Question

What are the scripts PerfInfo.vbs, ProcInfo.vbs, and RttInfo.vbs in the IR folder used for?

Answer

The scripts purpose in life was to collect additional system information during diagnostic collection during an IR event.  That said, the scripts have outlived their purpose as we now recommend leveraging LiveOps or other means of obtaining system information.

The scripts have been deprecated and removed starting with the 3.6.x sensor and higher.

Related Content

https://community.carbonblack.com/t5/Using-Carbon-Black-for-Incident/gp-p/g-1040
How To Provide A Malware Sample To Carbon Black Support