Alerts received on "SYSTEM" process include no information on the underlying system process triggering the alert

Products

• Carbon Black Cloud Enterprise EDR

Issue/Introduction

• Alerts received on "SYSTEM" process include no information on the underlying system process triggering the alert
• "CMD" for the SYSTEM process within Alert Details is blank

Environment

• Carbon Black Cloud Console: Current Version

Cause

• SYSTEM is not a process, it is a number of kernel threads, but for the purposes of collecting those into a process, the OS refers to these as SYSTEM.
• There is no hash or underlying executable, therefore it is not signed.

Resolution

This is an expected behavior for SYSTEM processes. No changes required.