CB Response: Command Line Search from Process Analysis Fails with \n in cmdline

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When clicking the command line in the process analysis page, a 400 error is displayed
{"reason": "query_syntax_error"}

Environment

• Carbon Black Response Server: 6.5.x and before

Cause

The command line has a line break in it \n

Resolution

• Upgrade to server version 7.0.1 or above
• Command Line is tokenized by space and forward slash. Utilize a search word between spaces or slashes to get results.

Additional Information

• Corrected in CB-27637