EDR: Process Analysis Export Results are Missing Events

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Exported events are less than the events viewed on the Process Analysis page.

Environment

EDR Server:  7.6.x

Cause

When exporting events within the process analysis page, results can be incomplete for very long running processes (for what is currently stored in Solr on disk)

Resolution

The current workaround is to pull the raw data from solr via the command line.  

Additional Information

• Prior to Exporting events, confirm the Process Analysis timeline is fully extended.