CB Response: How does data suppression affect process queries?
book
Article ID: 288097
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How does data suppression in the sensor group settings affect process queries?
Environment
CB Response: 6.x
Resolution
Enabling data suppression in the sensor group settings impacts the way that the cmdline string searches.
With data suppression enabled, the command line string for all child processes are included in the command line string of the process you're searching on.
Additional Information
Child processes that qualify for suppression do not have their own process document.