CB Response: How to prevent searches on empty fields in a query

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Query on a specific field only if there is a value in the field 

Environment

• CB Response Server: 6.0 and Above

Resolution

• Use the wildcard operator (*) with the field name to return results which only contain a value in that field.

  • field_name:*

    
     

Additional Information

• This can be used to improv query performance even when querying for specific values in a field.

  • domain:* AND -domain:carbonblack.com