CB Response: Some events ingesting despite Ingress filter settings

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Some events matching an ingress filter appear in the UI
• Selecting the process may load a completely different process
• A process document shows different processes per segment

Environment

• CB Response Server: All Versions
• CB Response Sensor: 6.1 and Higher
• Microsoft Windows: All Supported Versions

Cause

This is due to a sensor-side bug - CB-18338

Resolution

No fix at this time. The upcoming 6.3 Windows sensor is planned to resolve CB-18338

Additional Information

Servers with high load or performance issues may not filter out 100% of the incoming events that match a filter parameter