Why does the 3 day search not return events but those events are seen with the 1 week search?
Environment
EDR (formerly Response) Server: 6.x and above
Resolution
Design logic for optimizing searches can cause unexpected results when sensors are offline for a long time or backlog is large
Additional Information
Process searches use time ranges to narrow down the cores that are searched to help optimize search returns. This is done by the last_server_update field internally. last_update from the endpoint and last_server_update do not have to be the same but can lead to the discrepancy seen with the time range searches.
Searching All Time would not be prone to this, however should be used in rare cases