Unable to Use Special Characters in Process Search Query

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Process search fails when using special characters such as semicolon ;.
• Escaping with backslash \ fails.
• Using "double quotes" does not correct the issue.

Environment

• EDR Server: All Supported Versions

Cause

This is caused by enhanced tokenization within Solr.

Resolution

Adjust the query following the tokenization rules covered here.

Additional Information

With enhanced tokenization, the following characters are converted to white spaces and so removed before the command-line is tokenized: \ “ ‘ ( ) [ ] { } , = < > & | ;