Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Enterprise EDR: How do I enable Authentication Events Collection

Enterprise EDR: How do I enable Authentication Events Collection

Environment

  • Carbon Black Cloud Console
    • Enterprise EDR
  • Microsoft Windows: All Supported Versions

Question

How do I enable authentication event collection?

Answer

  1. Upgrade sensors to version 3.9.1+. 
  2. Enable "Auth Event Collection" under the Policy > Sensor tab

Additional Notes

  • This requires the Enterprise EDR Sku
  • If Enterprise EDR is enabled and this option is not showing please contact support

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-04-2023
Views:
421
Contributors