CBC: Can LiveQuery scan Windows drives for ASCII file content searches?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Can LiveQuery scan Windows drives for ASCII file content searches?

Environment

• Carbon Black Cloud Sensor: All versions
• Carbon Black Cloud Server: All versions
• Microsoft Windows: All supported versions

Resolution

No. LiveQuery cannot scan ascii file contents.

Additional Information

One CAN use LiveQuery to search by filename. For instance:
 

select * from file where path like '\windows\system32\%.exe';

will list all .exe files in the \windows\system32 folder.