Hi everyone! I’m pretty new to Carbon Black (and honestly to security tools in general 😅). My team just started using it to monitor our server workloads, and I’m trying to get a handle on the memory analysis feature.
I’ve got it installed on a few Windows Server 2019 VMs, and the file and process monitoring seems to be working okay. But when I try to run a memory scan or view memory events in the console, I’m not getting any data back. It just shows as “no results” or sometimes the option looks grayed out.
I checked the docs and made sure the policy has memory analysis enabled. I also verified the sensor status shows as “normal.” Is there something obvious I might be missing? Like, do I need to adjust a specific setting on the server itself, or maybe there’s a common permission issue?
I come from a project management/collaboration tool background (we live in Asana and Slack!), so the deep security stuff is a bit outside my comfort zone. Any tips would be super appreciated!
Thx!
Yeah, that "normal" sensor status can be misleading sometimes. I've run into this where the sensor's fine, but the memory scanning driver didn't load properly on the server. Can you check the Event Viewer on one of those VMs? Look under Applications and Services Logs, VMware Carbon Black EDR, for any errors from the "CarbonBlackK" source. A reboot sometimes kicks it loose.
Coming from Asana and Slack, think of it like a broken integration - the main app works, but the specific plugin is failing silently.
Totally. That driver load issue is sneaky. In my environment, we found Windows Defender's "Memory Integrity" feature (Core Isolation) can block it. Had to add an exclusion for the CarbonBlackK driver path, not just the process.
If a reboot doesn't fix it, that's the next place I'd look.