Why are Some Processes Listed as (unknown)?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why are some processes listed as (unknown) in the process tree?

Environment

• Carbon Black EDR: All Versions
• Linux: All Supported Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

This is a technical limitation of the sensor. Potential causes include:

• Processes that are already running prior to Sensor startup will be missing ProcessStart data and shows as unknown.
  • This includes OS boot processes required before the kernel is allowed to hook. 
  • New sensor installation. 
  • Sensor services stopped then started. 
• Server is shutdown while event data is being processed in datastore.

Additional Information

• Despite the items listed, EDR still typically captures 99.9% of all events that occur.
• For the 0.1% dropped, the Console UI renders these as Unknown Processes.
• During boot, the kernel will capture and hold events in memory until the user service is able to start to process them.