CB Response: Binary Search Facets Fail to Load Due to Large Number of Binaries

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Binary Search page does not show any Facets
• Binary Search results never filter when adding criteria
• HAR trace shows 500 errors on queries

Environment

• CB Response Server: 6.x
• Millions of unpurged Binaries

Cause

This is caused by a timeout in the facets loading, due to the number of items it's querying against.

Resolution

1. Restart the CB Response services and verify if the issue has been resolved: https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-restart-server-services/ta-p/41294
2. If the issue is not resolved, the best step would be to enable CBModule purging to reduce the number of items: https://community.carbonblack.com/t5/Knowledge-Base/How-To-Enable-Automated-Cbmodule-Purging/ta-p/33620
3. If the purge is already enabled, a timeout has been seen on the Hostname facet which can be disabled: https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-Binary-Search-spins-and-fails-to-load-results/ta-p/40601