Driver and Component Failures

This topic describes Carbon Black EDR Windows sensor driver and component failures.

Cause

This alert occurs if Netmon, Svc component, or core drivers fail to load.

Impact

The sensor does not collect netconn events if the Netmon driver fails. The sensor can stop collecting one or more event types if Svc component fails. The sensor does not collect any events if the core driver fails.

Severity Scale

Driver failure	Health score	Message
Svc component	-25	Svc component failure
Netmon driver	-25	NetMon stream driver failure
Core driver	-100	Core driver failure

Remediation

Restart the failed service. For Netmon issues, a system reboot and re-installation of the network driver might be necessary if issues persist. Contact Carbon Black Technical Support if issues continue.