CB Response: missing investigation event data
search cancel

CB Response: missing investigation event data

book

Article ID: 290676

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

A CB Response investigation (https://cb_server/#/investigation/1) with events older than 365 days are no longer available.

Environment

  • CB Response Server: All Versions

Cause

The SQL purge maintenance cron job deletes events within the tagged_events pgsql table that are older than 365 days for performance purposes.

Resolution

The product is operating as designed.