Enterprise EDR: Netconn_Count results vary between Investigate and Process Analysis pages

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Querying netconn_count displays differing results on Investigate page 
• Process analysis page returns different number of netconns

Environment

• Carbon Black Cloud Web Console: All Versions
• Enterprise EDR Windows Sensor: 3.4.x and newer
• Enterprise macOS Sensor: 3.4.1.7 and newer
• Microsoft Windows: All Supported Versions
• Apple macOS:: All Supported Versions

Cause

VMware Carbon Black is investigating the discrepancy in the returned results between the pages.

Resolution

The article will be updated when there is more informaiton.