Parent_process metadata is missing from events causing false positive query results

Products

• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Endpoint Standard

Issue/Introduction

Starting on April 22nd the events in the Carbon Black Console were missing the parent_process metadata, which lead to false positive query results on Investigation tab and EEDR watchlists.

Environment

• Carbon Black Cloud Console: April 22, 2026 through April 24th 2026

Cause

After a planned release a defect was detected which resulted in missing fields (those fields beginning with 'parent_') in a subset of event and alert data in long-term storage. 

Resolution

The affected code was rolled back on the Carbon Black Cloud backend on April 24, 2026 and testing was added to catch this behavior if it were to ever repeat in the future.

Additional Information

An official outage was documented on the Broadcom Status page.