CB Response: How to search for processes with no cmdline
book
Article ID: 287718
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Search for processes with empty cmdline line or the reverse: search for processes with a non-empty cmdline
Environment
- CB Response: All versions
Resolution
- To search for processes with *no* cmdline value, add:
-cmdline:*
- To search for processes that have any cmdline value (not empty), add:
cmdline:*
Feedback
thumb_up
Yes
thumb_down
No