Endpoint Standard: The process_publisher is not searchable
search cancel

Endpoint Standard: The process_publisher is not searchable

book

Article ID: 287476

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

  • Searching for process_publisher values return no results
    • ex.¬†process_publisher:"Google\ LLC" OR process_publisher:"Google,\ Inc"

Environment

  • Carbon Black Cloud: All supported versions
    • Endpoint Standard (formerly CB Defense)

Cause

Searching query "process_publisher" is only usable in environments with Enterprise EDR enabled.

Resolution

This is by design. Use of "process_publisher" is only available under the Investigate Processes tab with Enterprise EDR.