Where are memdumps stored on Carbon Black Response server after Live Response session
After performing a Live Response / GoLive session and requesting a memdump, they are uploaded automatically to your Carbon Black Response server.
When the memdumps are uploaded to your Carbon Black Response server, where are they stored?
Each Live Response session will create a new subfolder in the following directory:
This is the directory, as long as you have /var/cb/data as the DatastoreRootDir, which is what it is by default. If you have moved this, check the new location for the /live-response/sessions directory.