CB Response: Command Line Displayed Incorrectly In UI and Event Forwarder Data For Childproc Started Event
book
Article ID: 287722
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Mismatch between a process name/md5 and the cmdline shown in the UI and Event Forwarder data.
- Relates to processes that fork/exec other processes.
Environment
- CB Response Server: 6.2.0 and Higher
- CB Response Sensor: All Supported Versions
- Apple macOS: All Supported Versions
- Linux: All Supported Versions
Cause
This is a known issue, currently in Engineering as CB-17152.
Resolution
A solution is under investigation by Engineering; this article will be updated as further information is known.
Additional Information
There are no known workarounds to this issue at this time.
Feedback
thumb_up
Yes
thumb_down
No