Sites that have bandwidth or stability issues might experience performance problems or failures with Live Response. To help mitigate these issues, you can adjust the data transfer chunk size and also enable throttling of data transfers between the Carbon Black EDR console and sensors during a Live Response session.

Changes to these settings affect only Live Response, and are effective only on commands that you issue after the changes are saved. The settings apply to all users.

Prerequisites

Live Response must be enabled before you can modify its settings. See Enable or Disable Live Response through cb.conf or Enable or Disable Live Response through the Console.

Procedure

  1. Log in as a Global Administrator (Carbon Black EDR) or Administrator (Carbon Black Hosted EDR).
  2. Click Username > Settings.
  3. Click Advanced Settings and scroll to the Live Response section.
  4. In the Live Response Network Usage Tuning section, under Data Transfer Chunk Size, set new Download from Sensor (GET) and/or Upload to Sensor (PUT) values. The default value for both settings is 4MB.
  5. In the same section, check the box for Throttle Session Data Transfers if you want to activate throttling. Throttling is turned off by default, and it must be turned on before you can edit its value.
  6. Set the throttling speed in Download from Sensor (GET) to a new value. The default setting when throttling is first activated is 512KB.
  7. Click the Save changes button.