CB PSC: Delay in Observation events

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Process data from today is available in the console
• Observation events data has no new events for several days

Environment

• CB PSC
  • CB ThreatHunter
  • CB Defense

Cause

Reports are being generated faster than they can be uploaded due to a crashing service. To reduce the sensor footprint, reports are pruned.

Resolution

• Investigate the cause of the crash
• If the sensor is involved, an API bypass for the path may be added as a workaround