This metric records kernel handles usage from the sensor service. This metric does not include GDI (Graphics Device Interface) or user handles. Sensors that are running on Windows XP x86 do not report this metric.

Cause

Carbon Black EDR sensor service kernel handle usage is above normal values.

Severity Scale

Handles

Health score

Message

> 500

-5

Elevated handle count

> 1000

-10

High handle count

> 2000

-25

Very high handle count

> 4000

-50

Excessive handle count

Remediation

Analyze event collection to see if a specific event type is generating an excessive count. If these are non-binary file writes, this collection type can be often be turned off. See https://community.carbonblack.com/t5/Knowledge-Base/Turning-off-event-collection-of-Non-Binary-file-writes/ta-p/45819.