CB Response: Why do the Numbers Differ on Triage Alerts Page from Process or Binary Search Pages?
book
Article ID: 287379
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Why do the Numbers Differ on Triage Alerts Page from Process or Binary Search Pages?
Environment
CB Response Server: All Supported Versions
Resolution
Ensure that 'group-by process' is selected, this gives us a closer count.
With 'group-by process' unchecked the process search will list all segments that match the query which could be 'many per-process', resulting in a larger than expected amount of processes.
Despite 'group-by process' being checked count discrepancies may be observed due to feeds changing over periods of time. In that: they may have initially produced a hit but the feed might have changed so that the previous hit would no longer result in a hit. The same can be said for the inverse.