Version
All Carbon Black versions
Question
Is Carbon Black designed to track and report on attempted TCP connections (successful or unsuccessful)?
Answer:
Yes.
The Carbon Black sensor will track TCP connections and report them as netconn events, as long as a TCP connection is attempted, regardless of being successful or not.
However, if a connection fails before the TCP connection is attempted (e.g. failed DNS resolution when the machine is disconnected from the network), it will not track this and a netconn event should not be expected.
#EDR