Not seeing telemetry when using VMware Carbon Black Cloud Endpoint Standard

Issue

When reviewing Red Canary, the user only sees updates for sensor check-ins but no updates for the sensor activity column on the Endpoints page if they are using VMware Carbon Black Cloud Endpoint Standard.

Environment

VMware Carbon Black Endpoint Standard.

Resolution

There may be two reasons for why the VMware Carbon Black Cloud sensor is not collecting telemetry:

1. Enterprise EDR is not enabled.
   • Red Canary is only able to process native alerts from Endpoint Standard.
2. Sensor is in bypass.

   • Sensors in bypass mode are NOT actively protected. Sensors will continue to check-in with the VMware Carbon Black Cloud backend. No activity will be monitored or logged and no policy rules will be enforced.

If your organization has paid for Enterprise EDR and it is not enabled, please contact your Customer Success Manager.

If an endpoint was placed into Bypass and it was not an intentional action, please open a support ticket for further troubleshooting.