Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Response: Filtering in Process Analysis returns several empty Event pages

Cb Response: Filtering in Process Analysis returns several empty Event pages

Environment

  • Response 6.1.1+

Symptoms

  • Filtering on a facet or term in Process Analysis does not reduce the number of event pages and multiple pages may be blank or contain a few matched results.

Cause

This behavior is related to changes in the 6.x architecture. Event results are now split into 500 events per page.

Prior to 6.x, there was a 10k limit to the number of events recorded per process. This limit was removed in 6.x with processes being stored across multiple segments throughout the lifetime of the process.

Since some processes, such as Chrome, contain tens of thousands of events, performance in 6.1 greatly decreased when loading a process and its events. In 6.1.1, this was fixed by setting the 500 event limit per page. This limit cannot be adjusted and will always start at the first 500 events in the selected timeline, even when facet or text filtering is applied which is why the number of pages does not change.

Resolution

When filtering on a specific facet or term, you must click through each page of events to find all results. You can limit the number of events returned by reducing the timeline scrubber at the bottom of the Event Timeline graph.

2017-12-19_16-14-02.gif

If you know the event, you can also search for the process and event type from the Process Search. This will load the events on the process page related to the segment the event is on. You may still need to select through multiple pages, but it will be smaller than the full list of process events.

Related Content

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-14-2017
Views:
956
Contributors