Carbon Black Cloud: Obersavation Events Missing - Processes Tab Still Shows Data
search cancel

Carbon Black Cloud: Obersavation Events Missing - Processes Tab Still Shows Data

book

Article ID: 288295

calendar_today

Updated On:

Products

Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Items are showing under "Processes" but missing under "Observations" Tab

Environment

  • Carbon Black Cloud Console: All Versions
    • Endpoint Standard
    • Enterprise EDR

Cause

Bypass rule in place

Resolution

  1. Confirm if there are any bypass rules for the processes/paths associated with the event
  2. Remove any bypass rules and test again

Additional Information

Observation events are primarily made up of data from the "endpoint standard" feature. If a bypass rule is in, data in Observation events will be limited