CB Response: Are Windows process event cmdline values truncated?

[#1]

Environment

• CB Response Windows Sensor: 6.2.1 and older
• Microsoft Windows: All supported versions

Question

How many characters of a Windows cmdline command will the CB Response sensor capture?

Answer

CB Response Windows sensor 6.2.1 and older:

• 4096 characters

CB Response Windows sensor 6.2.2 and newer:

• 32k characters, which is the Windows OS limit.

Additional Notes

For endpoints version 6.2.2 and above, there essentially is no limit. 

Related Content

EDR: Partial or Truncated Messages using Syslog/Event Forwarder