CB PSC: Inbox Log Missing Entry Found in Audit Log

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Inbox log shows entry that cannot be correlated to a matching entry in the Audit Log
  • I.e. Audit Log has an entry for 'Sensor Bypass Enabled (User Action), but no relevant bypass entry found in Inbox Log

Environment

• CB PSC Web Console: All Versions
  • CB Defense
  • CB ThreatHunter

Resolution

This is working by design; the Audit Log will capture all activity, while the Inbox Log only records sensor actions.

Additional Information

• RepCLI commands are technically not considered sensor actions, so they do not appear in the Inbox.
• There is an open Feature Request on Idea Central to add this improvement to the product, found here: https://community.carbonblack.com/t5/Idea-Central/Improve-Inbox-logging-to-better-match-Audit-Log-entries/idi-p/73573#M8176