EDR: Process Analysis Export Results are Missing Events
book
Article ID: 287661
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Exported events are less than the events viewed on the Process Analysis page.
Environment
EDR Server: 7.6.x
Cause
When exporting events within the process analysis page, results can be incomplete for very long running processes (for what is currently stored in Solr on disk)
Resolution
The current workaround is to pull the raw data from solr via the command line.
Additional Information
Prior to Exporting events, confirm the Process Analysis timeline is fully extended.