EDR: Inconsistent Results When Using the Custom Timeframe Search from the Drop-down on Process Search Page
book
Article ID: 289094
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Searches using a custom time frame can sometimes show inconsistent results over smaller time periods (1-2 days)
Environment
- EDR (formerly CB Response) Console: 6.2.4 and Higher
- Process Search page
Cause
- Appears to be a repeatable defect that is being investigated in EA-13970
Resolution
There is no resolution at this time, because this issue is still under investigation.
Additional Information
- Workaround: You can use the '+ Add Search Terms' function to specify a time period and the results should show consistently.
- Set the Time dropdown for ALL TIME, then Click '+Add Search Terms'
- Choose Criteria dropdown > Time > Last Event received
- Click the radio button for the After/Before section and put in the date
- Click Add Terms
Feedback
thumb_up
Yes
thumb_down
No