Carbon Black Cloud: Why are Events not/no longer visible in the console?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why are Events not/no longer visible in the console?

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard (Formerly CBD): All supported Versions
• EEDR (Formerly CBTH): All Supported Versions

Resolution

The Data Retention Limit for the Org has been reached

Additional Information

• Endpoint Standard: Alert Events (those with an AlertID) are stored for 180 days if they are associated with an alert, 30 days otherwise
• EEDR: Events are stored for 30 days
• In ES + EEDR orgs, the Investigate and Process Analysis page are working off the 30 day store that EEDR uses, so data retention is lowered