CB Response: How to search for processes with no cmdline

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Search for processes with empty cmdline line or the reverse:  search for processes with a non-empty cmdline

Environment

• CB Response: All versions

Resolution

• To search for processes with *no* cmdline value, add:

-cmdline:*

• To search for processes that have any cmdline value (not empty), add:

cmdline:*