Turn off Event Collection of Non-binary File Writes

Some endpoints produce large amounts of non-binary files types, and can therefore produce a massive inbound queue of mostly uninteresting files. This can lead to decreased data retention and system resource usage to ingest this data on the server. If the large amount of non-binary file writes is determined to be an issue, perform the following procedure to turn off this type of event collection.

For the most part, Carbon Black EDR does not record information regarding non-binary files types. However, Carbon Black EDR does record file writes of certain non-binary file types. The following is a list of non-binary files types that the Carbon Black EDR sensor records when they are written to disk:

PE	Elf	UniversalBin
EICAR	OfficeLegacy	OfficeOpenXml
Pdf	ArchivePkzip	ArchiveLzh
ArchiveLzw	ArchiveRar	ArchiveTar
Archive7zip

Procedure

1. You can create a new sensor group to contain the sensors that are generating the non-binary file write events, or you can edit an existing sensor group. See Create or Edit a Sensor Group (macOS or Windows Sensors) for step-by-step instructions.
2. Click the Event Collection tab.
3. Deselect the Non-Binary File Writes check box.
4. Save the sensor group.
5. Add sensors to the sensor group as needed. See Move Sensors to Another Group.