Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Is Carbon Black designed to track and report on TCP connections?

Is Carbon Black designed to track and report on TCP connections?

Version

All Carbon Black versions

Question

Is Carbon Black designed to track and report on attempted TCP connections (successful or unsuccessful)?

Answer:

Yes.

The Carbon Black sensor will track TCP connections and report them as netconn events, as long as a TCP connection is attempted, regardless of being successful or not.

However, if a connection fails before the TCP connection is attempted (e.g. failed DNS resolution when the machine is disconnected from the network), it will not track this and a netconn event should not be expected.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-30-2015
Views:
1054
Contributors