EDR: Inconsistent Results When Using the Custom Timeframe Search from the Drop-down on Process Search Page

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Searches using a custom time frame can sometimes show inconsistent results over smaller time periods (1-2 days)

Environment

• EDR (formerly CB Response) Console: 6.2.4 and Higher
• Process Search page

Cause

• Appears to be a repeatable defect that is being investigated in EA-13970

Resolution

There is no resolution at this time, because this issue is still under investigation.

Additional Information

• Workaround: You can use the '+ Add Search Terms' function to specify a time period and the results should show consistently.
  • Set the Time dropdown for ALL TIME, then Click '+Add Search Terms'
  • Choose Criteria dropdown > Time > Last Event received
  • Click the radio button for the After/Before section and put in the date
  • Click Add Terms