Access official resources from Carbon Black experts
Email alerts are received with a title of Computer Security Alert - Suspicious behavior detected
The body of the alert may contain a message such as:
Agent tampering prevented (DOMAIN\PCNAME). Modification of 'c:\programdata\bit9\parity agent\cache.chk-journal' by 'NT AUTHORITY\SYSTEM' was blocked because of tamper protection.
A process, such as an AV program, is attempting to scan one or more of the CB Protection (Bit9) files or folders. The agent is preventing this, and generating a tamper protection alert.
To determine what process is the root cause of these alerts, you can check the events in the console.
From this view, you can see the process generating the alerts, and take action as needed.
If the alerts are found to be due to AV software, make sure that you have the necessary exclusions in place as outlined in Anti-virus exclusions for CB Protection (formerly Bit9) agent .