EDR: How to Use the Process Search Term 'process_id'

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to use the Process Search Term 'process_id'.

Environment

EDR Server:  7.x

Resolution

The process_id field requires the process GUID, not the process PID. 
1. Obtain the process GUID which can be found on the Process Analysis page or in a raw process document.

a) Process Analysis page:

b) Raw process document:

2. Use the process GUID in the process_id search term.

process_id:00000002-0000-1c2d-01d8-8037b8dee543

Example:

Additional Information

• The process_id value is an internal Carbon Black EDR process guid for the process. A long value.