How to Search for Enriched Events

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Effectively search for Enriched Event data on the Investigate page

Environment

• Carbon Black Cloud Console: All Versions
  • Enterprise EDR
  • Endpoint Standard

Resolution

1. Navigate to the Investigate page
2. Leverage one of the two following searches

• To find all enriched data

enriched:true

• To find all non-enriched data

-enriched:true