Older Investigation Event Data is Missing

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Investigation (https://cb_server/#/investigation/1) with events older than 365 days are no longer available.

Environment

• Carbon Black EDR Server: All Versions

Cause

The SQL purge maintenance cron job deletes events within the tagged_events pgsql table that are older than 365 days for performance purposes.

Resolution

The product is operating as designed.