CB Response: How to Use Whitespace in a Query

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to use whitespace in a CB Response Query? 

Environment

• CB Response: All Supported Versions

Resolution

• Whitespace is the default delimiter.
• A query with whitespace would be “tokenized” and parsed as multiple terms.
• Use quotation marks to avoid automatic parsing into individual terms.
• Alternatively, escape whitespaces using the backslash (\).

Additional Information

• This input: microsoft office\office15\powerpnt.exe Is interpreted as two terms: microsoft AND office\office15\powerpnt.exe
• This input: "microsoft office\office15\powerpnt.exe" Is interpreted as: microsoft office\office15\powerpnt.exe
• This input: microsoft\ office\office15\powerpnt.exe Is interpreted as: microsoft office\office15\powerpnt.exe