Carbon Black Cloud: Does a Wildcard Query on a Search Field Return Null Values?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Are wildcard queries against a search field expected to return results containing no value?
• Example: Would the following query return unsigned processes?  

  process_publisher:*

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud APIs

Resolution

• No, query results will not include results where the field searched contains a null value.
• In the example provided, only signed processes would be returned because unsigned processes contain no value for the process_publisher field. 

Additional Information

Advanced search criteria and operators can be leveraged to obtain the desired results.