logo

Knowledge Base

Access official resources from Carbon Black experts

IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Enterprise EDR: How do I enable Authentication Events Collection

Enterprise EDR: How do I enable Authentication Events Collection

Environment

  • Carbon Black Cloud Console
    • Enterprise EDR
  • Microsoft Windows: All Supported Versions

Question

How do I enable authentication event collection?

Answer

  1. Upgrade sensors to version 3.9.1+. 
  2. Enable "Auth Event Collection" under the Policy > Sensor tab

Additional Notes

  • This requires the Enterprise EDR Sku
  • If Enterprise EDR is enabled and this option is not showing please contact support

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
CB_Support
Creation Date:
‎05-04-2023
Views:
450
Contributors
logo

Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.