EDR: Unable to View Fileless Scriptload Events

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Unable to view Fileless Scriptload behavior after enabling the collection the sensor group settings

Environment

• EDR Console: 7.2 and Higher
• EDR Sensor: 7.1.0 and Higher
• Micosoft Windows: All Supported Versions

Cause

Filess Scriptload is only captured via the raw sensor exchange data in the cb-event-forwarder and pushed to a SIEM. 

Resolution

At this time, the events are not viewable in the console. This feature is tentatively slated for 7.5.0 server release