EDR: Not All Facets Show in the Left Panel on Process Search
search cancel

EDR: Not All Facets Show in the Left Panel on Process Search

book

Article ID: 287952

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When doing a process search, not all facets are displayed such as hostname when it is seen on another page. 

Environment

  • EDR Console: All Versions

Cause

Facets are expensive and in order to make sure the search page displays results as quickly as possible, a timeout is built in and returns the results captured during that time. 

Resolution

For servers that have enough resources, threading can be added to return more results quicker.
  1. Open /etc/cb/cb.conf for editing
  2. Add the following config into the file
    CoreServicesMaxFacetThreads=1
  3. Restart services EDR: How to Restart Server Services