Environment
- EDR Sensor: All Versions
- Windows: All Supported
Question
Why do several of my sensors show excessive event loss, but when I refresh the console they show Health 100/100
Answer
- The sensor drivers load much sooner than the user mode service
- This leaves the user mode service playing catch to the events that the driver has generated
- Once the service has caught up on events the health will change to the more correct level
