Enabling and Disabling the EMET Protection Feed

The Threat Intelligence Feeds page includes an EMET Protection feed. This feed is disabled by default.

You can enable it to include EMET event reports with the other reports that are received on the Carbon Black EDR server. When the EMET Protection is enabled, you can enable the following:

• Carbon Black EDR console alerts based on EMET events

• Delivery of an email alert when an EMET event occurs

• Inclusion of EMET events in the syslog output from the Carbon Black EDR server

For instructions on enabling a feed and configuring its alert and syslog features, see “Enabling, Disabling, and Configuring a Feed” in the VMware Carbon Black EDR User Guide .

For more information on the Threat Intelligence Feeds page, see “Threat Intelligence Feeds” in the VMware Carbon Black EDR User Guide .

Note:

The Carbon Black EDR server receives EMET events regardless of whether the EMET Protection feed is enabled. EMET event collection can be disabled per-sensor group from the Group Settings page in the Carbon Black EDR console.