This metric records kernel handles usage from the sensor service. This metric does not include GDI (Graphics Device Interface) or user handles. Sensors that are running on Windows XP x86 do not report this metric.


Carbon Black EDR sensor service kernel handle usage is above normal values.

Severity Scale


Health score


> 500


Elevated handle count

> 1000


High handle count

> 2000


Very high handle count

> 4000


Excessive handle count


Analyze event collection to see if a specific event type is generating an excessive count. If these are non-binary file writes, this collection type can be often be turned off. See