EDR: Sensors taking up too much bandwidth

[#1]

Environment

• CB Response Server: All Supported Versions
• CB Response Sensor: All Supported Versions

Symptoms

Sensors are utilizing available bandwidth, which is causing network bottlenecks.

Cause

Bandwidth limitations in the environment.

Resolution

There are several steps that will help resolve this issue:

1. Enable Site Throttling within the Response UI.
2. Increase available bandwidth for the impacted environment.
3. Reduce the total amount of local data collected by the Sensor.

Additional Notes

• EDR Sensors are working as designed but may need to be tuned to match the network availability of the environment they are deployed to.
• This issue can also occur in environments where the sensor backlog has grown at a rapid pace, such as an EDR Server outage.