Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Response new Version 2 tokenization and query capability not working (immediately).

Cb Response new Version 2 tokenization and query capability not working (immediately).

CB Response Server 6.1 or greater


The  6.1.x Cb Response Release Notes document new "Version 2" or "V2" tokenization/query capability

(See "Improved Command-line Searches" on page 10)

Carbon Black Response v6.1 - Release Notes


After following the steps documented (modifying the Master and each Minion's cb.conf and restarting services),

the new searching features do not immediately work.

For example, V2 tokenization now allows one to search for the string ".exe" as file extensions are now searchable fields as so:


but this search will not return any results.

For V2 tokenization to take effect,

first the cb.conf files need the added line


and only then will the next new "writer core" be created with that capability, and only new data ingested  in this core

will be accessible with the new V2 searching. Keep in mind that new writer cores are created every

three days, so V2 Tokenization can take up to 3 days before it takes effect.

For example,  if an administrator edits all the cb.confs for each Cb server on Monday,

it may take until up to Thursday until all  new writer cores are created on all servers that will support V2 Tokenization.

The way to verify a core now supports v2 tokenization is to look at the text file


and check the value for this line:


This means any events injested into this core will be searchable with the new capabilities.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Creation Date: