IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

EDR: How does a linux sensor interact with the kernel?

EDR: How does a linux sensor interact with the kernel?

Environment

  • EDR Sensor: 6.x and Higher

Question

How does a linux sensor interact with the kernel?

Answer

The kernel module is a character device. The interaction is with read and write calls through the device file /dev/cbsensor.

Related Content

The kernel module source code is publicly available at: vmware/cbsensor-linux-kmod

Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-23-2020
Views:
614
Contributors