CB Response: Not Seeing Cmdline on Email Alert Even It's a Part of The Watchlist Query

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Customers are not seeing cmdline in the watchlist email alert even it's a part of the watchlist query.

Environment

• CB Response Server: All versions

Cause

Due to SOLR tokenizer limitation.

Resolution

Future release CB-13387.

Additional Information

• The product relies on SOLR highlighting function to present trigger information in our email template.
• Limitations on tokenizer causes certain terms not being highlighted.
• There is no ETA for the fix at this moment.