CB Defense: TTPs are missing from Alert Notifications
search cancel

CB Defense: TTPs are missing from Alert Notifications

book

Article ID: 290391

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

TTPs are missing from Alert Notifications

Environment

CB Defense PSC Console: All Versions

 

Cause

  • The notification service only sends one set of data out for an alert
  • Its possible that new events may be added after the alert is generated, and this will add additional TTPs to the Alert
  • If an alert is modified by the backend after the notification service sends data, the Connector / Email won't have the new alert info

Resolution

  • This is a limitation of the notification service
  • If the notification service waits until all possible events are added to an Alert, then notification delays would be observed, so currently notifications are sent immediately when an Alert is generated