Process Lineage tab shows no data for certain incidents

Products

• Endpoint Detection and Response

Issue/Introduction

When reviewing the Process Lineage data for certain incidents shows no data

Environment

Endpoint Detection and Response (EDR) 4.x

Cause

Not all AAT/TAA incidents may generate lineage tree. The incident must be triggered by a 4100 event (Bash SONAR, behavior detection) along with an 8001 FDR event at a time when a triggering 4100 event occurs.
AAT/TAA incident generated by the 4102 event (AV, file scan engine) will not generate a Linage Tree.

Resolution

This behavior is expected.