CB Response: missing investigation event data
book
Article ID: 290676
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
A CB Response investigation (
https://cb_server/#/investigation/1) with events older than 365 days are no longer available.
Environment
- CB Response Server: All Versions
Cause
The SQL purge maintenance cron job deletes events within the tagged_events pgsql table that are older than 365 days for performance purposes.
Resolution
The product is operating as designed.
Feedback
thumb_up
Yes
thumb_down
No