CB PSC: Investigate Action on Endpoints Page Returns No Data

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Selecting the Investigate icon on for a given endpoint on the endpoints page returns no process event data on the investigate page

Environment

• CB PSC Web Console: All Versions
  • CB ThreatHunter
  • CB Defense
• CB PSC Sensor: All Supported Versions

Cause

The cause of this issue is currently under investigation

Resolution

The current workaround is to perform the following:

1. Navigate to the endpoints page
2. Select the > icon next to a given endpoint
3. Copy the Device ID
4. Navigate to the investigate page
5. Enter the following search query
   • device_id:<device_ID_here>