CB Response: Query Blocked Due to Size of the Binary Store

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Error when trying to run a query:

Your query, which includes binary metadata, was blocked because the current size of the binary store could cause search performance issues. 
If you want to modify this behavior, use the Advanced Settings page (if you have permission) or contact your Global Administrator.

 

Environment

• CB Response Console: 6.2.x and Higher
• Linux: All Supported Version

Cause

This is a change in 6.2 in order to prevent performance issues

Resolution

From the CB Response Console:

1. Go to "(Username) > Settings > Advanced Settings
2. Uncheck the box for "Block Searches that Include Binary Metadata with Large Binary Stores
3. Click Save changes