Carbon Black Cloud: Obersavation Events Missing - Processes Tab Still Shows Data
book
Article ID: 288295
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Items are showing under "Processes" but missing under "Observations" Tab
Environment
Carbon Black Cloud Console: All Versions
Endpoint Standard
Enterprise EDR
Cause
Bypass rule in place
Resolution
Confirm if there are any bypass rules for the processes/paths associated with the event
Remove any bypass rules and test again
Additional Information
Observation events are primarily made up of data from the "endpoint standard" feature. If a bypass rule is in, data in Observation events will be limited