Endpoint Sensor: Carbon Black Response


Carbon Black Response continuously records endpoint activity across your organization


Visibility is the foundation of any endpoint detection and response solution.

Carbon Black Response collects, correlates, and records an extensive set of endpoint telemetry. Red Canary uses the robust data set to analyze endpoints for signs of potential threats.



Carbon Black Response is the market’s leading EDR sensor. Thousands of organizations around the world rely on the sensor to collect low-level endpoint information and give visibility into activity across their environment.


Learn More About Carbon Black Response

Lightweight, Never Impacting Performance

Carbon Black Response is a kernel-level sensor that is only several megabytes large, and uses less than a percent of CPU. It avoids conflicts with other endpoint products and is unnoticeable to end users.

Complete Collection

Endpoint activity is locally collected on every endpoint, deduplicated and compressed, and then sent to the collection server for analysis. Unlike many products, sensors never wait for potential threats before delivering their data.

Remote Monitoring

Cloud infrastructure ensures endpoints are monitored and protected when they are both inside and outside of your corporate network. Whether down the hall, across the world, and on or off the VPN, you’re covered.

OS Coverage

Windows XP+, Windows Server 2003+, CentOS/RedHat 5.4+, and Mac OS X.

Cloud and VDI

Red Canary monitors systems run in a VDI environment, thin client setup, or elastic compute environments such as AWS. Bake the sensor into your gold image and ensure systems are monitored the moment they come online.

Existing Carbon Black Response customer?


START A 30 DAY ENDPOINT ASSESSMENT

An investment firm improves visibility with Carbon Black Response


LEARN MORE