CB Response: Command Line Displayed Incorrectly In UI and Event Forwarder Data For Childproc Started Event

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Mismatch between a process name/md5 and the cmdline shown in the UI and Event Forwarder data.  
• Relates to processes that fork/exec other processes.

Environment

• CB Response Server:  6.2.0 and Higher
• CB Response Sensor: All Supported Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions

Cause

This is a known issue, currently in Engineering as CB-17152.

Resolution

A solution is under investigation by Engineering; this article will be updated as further information is known.

Additional Information

There are no known workarounds to this issue at this time.