Access official resources from Carbon Black experts
Advanced Search
IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!
EDR: What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?
Environment
EDR Sensor: All supported versions
Question
What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?
Answer
Once the 'Sensor-side Max Disk Usage' threshold is hit, the sensor will stop ingesting all new events, while preserving those that are already in the sensor's current backlog.
