CB PSC: Inbox Log Missing Entry Found in Audit Log
search cancel

CB PSC: Inbox Log Missing Entry Found in Audit Log

book

Article ID: 287535

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

  • Inbox log shows entry that cannot be correlated to a matching entry in the Audit Log
    • I.e. Audit¬†Log has an entry for 'Sensor Bypass Enabled (User Action), but no relevant bypass entry found in Inbox Log

Environment

  • CB PSC Web Console: All Versions
    • CB Defense
    • CB ThreatHunter

Resolution

This is working by design; the Audit Log will capture all activity, while the Inbox Log only records sensor actions.

Additional Information

  • RepCLI commands are technically not considered sensor actions, so they do not appear in the Inbox.
  • There is an open Feature Request on Idea Central to add this improvement to the product, found here:¬†https://community.carbonblack.com/t5/Idea-Central/Improve-Inbox-logging-to-better-match-Audit-Log-entries/idi-p/73573#M8176