Endpoint Standard: The process_publisher is not searchable

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Searching for process_publisher values return no results
  • ex. process_publisher:"Google\ LLC" OR process_publisher:"Google,\ Inc"

Environment

• Carbon Black Cloud: All supported versions
  • Endpoint Standard (formerly CB Defense)

Cause

Searching query "process_publisher" is only usable in environments with Enterprise EDR enabled.

Resolution

This is by design. Use of "process_publisher" is only available under the Investigate Processes tab with Enterprise EDR.