CB Response: After server upgrade to 6.4.0, the initial Process Search page shows no facets or processes.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When initially going the process search page, facets are not filled out.
• After the page is rendered, clicking on the "search" button will then populate the facets as in previous versions.

Environment

• CB Response Console: 6.4.0 and Higher

Cause

This is new intended behavior and working as designed. This change omits a full wildcard search on all facets which, at times, caused a timeout error message.

Resolution

To view the facets:

1. Go to the Process Search page
2. Click on the "search" button in the upper right corner.
3. Process facets and a process list will now be populated as in previous releases

Additional Information

• Coding change in CB-17983 to improve performance on the process search page when a user first navigates to the page. 
• Performance is gained by not loading facet counts across the server, facets being expensive
• This does not affect the data or search integrity