CB Response: Parent does not load in process tree
book
Article ID: 290577
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- The parent process in the process tree is completely blank
- The back-end process content lists parent information
Environment
- CB Response Server: 6.3.0
Cause
This is a known issue with rendering parent processes starting in 6.3.0 - CB-24648
Resolution
- This will be fixed in a future server release
- As a workaround, the parent process can be found in the process document which can be gathered in the UI or backend
- UI - https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-output-process-document-information-in-a/ta-p/70325
- Backend - https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-get-raw-process-documents-via-Curl/ta-p/62572
Additional Information
- Information on the parent process in a process document will be in the fields that start with 'parent_'
- Example: "parent_name":"explorer.exe"
Feedback
thumb_up
Yes
thumb_down
No