EDR: Live Query Fails With "Parse error at offset 0: Inval" Error

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Running a Live Query Request Fails with the error "Parse error at offset 0: Inval"

Environment

• EDR Server 7.2 and Higher
• EDR Windows Sensor 7.2.x and Higher

Cause

This can happen if using Double Quotes instead of Single Quotes

Resolution

When building queries for Live Query use Single Quotes ' instead of Double Quotes " as this is the standard for SQL