Environment
- EDR Server: 6.x and Higher
Symptoms
- The number of events shown on the Process Analysis page does not match the number of events associated with the process in search results.
- Events associated with an alert do not appear in the Process Analysis page
Cause
- Minor discrepancies are caused by the Fuzzy Facets feature which returns an estimated guess of each event count
- Numbers off by hundreds or thousands of events are caused by a limit on the number of events per page returned in Process Analysis
Resolution
- To view all events of a process, the timeline on the Process Analysis page must be fully expanded
- Each page contains a predetermined set of 500 events, to view other events in the process, click through each page
Additional Notes
Related Content