How to Get Raw Process Documents via Cbsearch

Products

• Carbon Black EDR

Issue/Introduction

How to collect raw process documents for support troubleshooting using the cbsearch utility. 

Environment

• Carbon Black EDR: 7.9.1 and Higher

Resolution

1. Log into the EDR web console.
2. Perform a process search and click a resulting process to bring you to the Process Analysis page.
3. In the Process Analysis page grab the Unique ID (highlighted in red) from the browser URL 

   https://<server>/#/analyze/00000007-0000-24c8-01d4-6cab54141c72/1540927207635?cb.legacy_5x_mode=false

4. Open a backend terminal session with sudo privileges on the primary server.
5. Run this command with the unique id:

   /usr/share/cb/cbsearch --process <unique_id> --save
   ex:
   /usr/share/cb/cbsearch --process 00000007-0000-24c8-01d4-6cab54141c72 --save

6. Collect the file and attach it to the support ticket. The file will be found in /var/log/cb/<unique_id>.json
7. The file can be removed upon successful upload. 

Additional Information

• Searching Raw Solr Documents Using Cbsearch
• How to Get Raw Binary Documents via Cbsearch
• How to Get Raw Process Documents Via Curl
• How to Get Raw Process Documents Via Curl (Clustered)
• How to Get Raw Binary Documents Via Curl