Environment
- CB Defense Sensor: 3.3.x And Higher
- CB Defense Web Console: All Versions
- Microsoft Windows: All Supported Versions
- Mac OSX: All Supported Versions
- LiveQuery Feature Enabled
Question
When using the LiveQuery feature, what do the columns in the Device View mean?
Answer
The table below contains the column definitions, here is a screenshot of the device view from within the console for reference:
Column | Definition |
Device | The name of the endpoint that responded to the query |
Time | Timestamp for when the query returned to the Carbon Black console |
Results | The number of results which matched the query question |
Memory | The maximum amount of memory the query used on the device during query runtime |
Response Time | The amount of time it took to run the query on the device |
CPU Usage | The average amount of CPU the query used on the device during query runtime. This is also an average over all CPUs when multiple cores are present. |
Additional Notes
- Our new Device View inside the query results page reveals data regarding the impact of running the query on the selected devices. We are surfacing this data so you and your team can use the information to craft your queries appropriately.
- Please keep in mind the Memory and CPU stats are peak usage, and that if the CPU, or individual cores, are idle during the query then it can spike to near 100%.
- If the Response Time is more than five minutes, it is recommended that the query should be rewritten, or run during a time frame when the device will not be negatively impacted.