Malformed Syntax Error When Searching ipv6addr With a CIDR of 128

Products

• Carbon Black Hosted EDR (formerly Cb Response Cloud)
• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When doing a process search for an IPv6 address with a CIDR range of /128, a malformed syntax error is returned. 

Example Search:

 ipv6addr:::1/128

Environment

• Carbon Black EDR Console: 7.8.0 and Lower

Cause

IPv6 search handling did not account for single IP returned with IPv6 CIDR range. 

Resolution

The /128 CIDR is a single IP, instead use just the direct IPv6 address as a workaround. 

 ipv6addr:::1

Additional Information

• This will be corrected in the 7.9.0 server release with CRE-19180