This topic describes Carbon Black EDR Windows sensor driver and component failures.


This alert occurs if Netmon, Svc component, or core drivers fail to load.


The sensor does not collect netconn events if the Netmon driver fails. The sensor can stop collecting one or more event types if Svc component fails. The sensor does not collect any events if the core driver fails.

Severity Scale

Driver failure

Health score


Svc component


Svc component failure

Netmon driver


NetMon stream driver failure

Core driver


Core driver failure


Restart the failed service. For Netmon issues, a system reboot and re-installation of the network driver might be necessary if issues persist. Contact Carbon Black Technical Support if issues continue.