CB Response: missing investigation event data

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

A CB Response investigation (https://cb_server/#/investigation/1) with events older than 365 days are no longer available.

Environment

• CB Response Server: All Versions

Cause

The SQL purge maintenance cron job deletes events within the tagged_events pgsql table that are older than 365 days for performance purposes.

Resolution

The product is operating as designed.