EDR: What do the tamper levels represent in the sensor registrations table?

[#1]

Environment

• EDR Server: 7.4.0 and higher
• EDR Windows Sensor: All supported versions

Question

In the sensor_registrations.csv file, what do the numbers in the tamper_level column represent?

Answer

The tamper levels are as follows:

• tamper_level 0 = None
• tamper_level 1 = Detection
• tamper_level 2 = Protection

Additional Notes

• Tamper protection has minimum requirements to be supported. See more in the Tamper Protection of Windows Sensors section of the User Guide.
• More details regarding the tamper levels can be found in the User Guide

Related Content

Advanced Settings
EDR: How to Get Started with Tamper Protection?