Write a time specific query in the console to provide accurate results.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to write a query in the EDR Process Search console for a specific timeframe and get accurate results every time.

Environment

• EDR Server: All Versions

Resolution

Using the "+ Add Search Terms" option on the Process Search page and make a query for the specific time you want.

1. Set the Time dropdown for ALL TIME, then Click '+Add Search Terms'
2. Choose Criteria dropdown > Time > Last Event received
3. Click the radio button for the After/Before section and put in the date
4. Click Add Terms

Search results should match the timeframe successfully instead of using the time selector dropdown menu.