Carbon Black Cloud: Obersavation Events Missing - Processes Tab Still Shows Data

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Items are showing under "Processes" but missing under "Observations" Tab

Environment

• Carbon Black Cloud Console: All Versions
  • Endpoint Standard
  • Enterprise EDR

Cause

Bypass rule in place

Resolution

1. Confirm if there are any bypass rules for the processes/paths associated with the event
2. Remove any bypass rules and test again

Additional Information

Observation events are primarily made up of data from the "endpoint standard" feature. If a bypass rule is in, data in Observation events will be limited