Carbon Black Cloud: Watchlist alert for netconn count, but event shows no events

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Watchlist alert for a netconn event that is not present on the process page
• Investigate page search returns processes with netconn counts 

Environment

• Carbon Black Cloud Console: All Versions
  • Enterprise EDR (Formerly CB ThreatHunter): 
• Microsoft Windows: All Supported Versions

Cause

Sensor is reporting a netconn event, but failing to send event

Resolution

This is being investigated by VMware Carbon Black.