EDR: Not All Facets Show in the Left Panel on Process Search

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When doing a process search, not all facets are displayed such as hostname when it is seen on another page. 

Environment

• EDR Console: All Versions

Cause

Facets are expensive and in order to make sure the search page displays results as quickly as possible, a timeout is built in and returns the results captured during that time. 

Resolution

For servers that have enough resources, threading can be added to return more results quicker.

1. Open /etc/cb/cb.conf for editing
2. Add the following config into the file

   CoreServicesMaxFacetThreads=1

3. Restart services EDR: How to Restart Server Services