Difference Between Number of Watchlist Hits and Process Results Returned
Article ID: 286230
Updated On:
Products
Issue/Introduction
On the Watchlists page, sometimes there is a disparity between the number of "hits" a watchlist shows and the number of processes that are actually returned
Environment
- Carbon Black Cloud Console: Supported Version
- Enterprise EDR
Resolution
This is the difference in how processes vs hits are calculated. If a watchlist is only looking at metadata (e.g: process_cmdline) for a long running process, then anytime that process does anything (makes a netconn, filemod, etc), another hit will trigger. So it is possible to have more hits than processes, assuming that one (or more) of those processes would be responsible for multiple hits.
Additional Information
On the process analysis page, under the "Selected Node" at the bottom it will show you how many "hits" that process has triggered. Anything more than 1 accounts for the disparity between number of hits and number of resulting processes.
Feedback
