Process Analysis shows fewer events than listed in Process Search results

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• The number of events shown on the Process Analysis page does not match the number of events associated with the process in search results.
• Events associated with an alert do not appear in the Process Analysis page

Environment

• EDR Server: 6.x and Higher

Cause

• Minor discrepancies are caused by the Fuzzy Facets feature which returns an estimated guess of each event count
• Numbers off by hundreds or thousands of events are caused by a limit on the number of events per page returned in Process Analysis

Resolution

1. To view all events of a process, the timeline on the Process Analysis page must be fully expanded
2. Each page contains a predetermined set of 500 events, to view other events in the process, click through each page