CB Response: How to see most common processes on an endpoint using the web interface

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To use the CB Response web interface to determine which processes most commonly occur on a specific endpoint. 

Environment

• CB Response: 6.x

Resolution

1. Log into the CB Response web interface 
2. Click Process Search 
3. Set the time interval properly. 
4. Search on all events by hostname. Search on: 

hostname:<hostname>
example:
hostname:JanetWindowsComputer

5. Use the facets on the left to see what the most common processes are. 

Additional Information

• Optionally, you can look for events that include net conns by adding: 

hostname:<hostname> AND netconn_count:[1 TO *]

• Use ingress filtering to remove safe or unwanted process events.