Environment
- EDR (formerly CB Response) Sensor: All Supported Versions
- Microsoft Windows: All Supported Versions
Question
What is the folder "C:\Windows\CarbonBlack\store" used for?
Answer
- C:\Windows\CarbonBlack\store contains copies of binaries that have not yet been shared with the EDR server as well as a catalog of all observed binaries
- Any observed binary will be copied and stored in this location.
- Binaries will persist in the directory until the sensor checks in to the server.
- If the server does not have a copy of the binary, it is upload from the endpoint.
- If the server already has a copy of the binary, nothing is uploaded.
- Binary copies are then purged from the directory after check-in.
Related Content
