Carbon Black Cloud: Watchlist alert for netconn count, but event shows no events
search cancel

Carbon Black Cloud: Watchlist alert for netconn count, but event shows no events

book

Article ID: 286148

calendar_today

Updated On:

Products

Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Watchlist alert for a netconn event that is not present on the process page
  • Investigate page search returns processes with netconn counts¬†

Environment

  • Carbon Black Cloud Console: All Versions
    • Enterprise EDR (Formerly CB ThreatHunter):¬†
  • Microsoft Windows: All Supported Versions

Cause

Sensor is reporting a netconn event, but failing to send event

Resolution

This is being investigated by VMware Carbon Black.