Environment
- EDR Windows Sensor 6.x and below
- EDR Linux Sensor: All Supported Versions
- Microsoft Windows: All Supported Versions
- Linux: All Supported Versions
Symptoms
- The parent in Process Analysis changes when refreshing or selecting sibling / parent processes
- Searches by parent process may return processes with different parents
- Segments in the process document show different parents between segments
Cause
This is a known issue for Windows Sensor that occurs when a process ID matches for two different processes - CB-18338
This is also a known issue for the EDR Linux Sensor that is being resolved in CB-21348
Resolution
- Upgrade Windows sensor to version 7.0.1 and above for the fix
- This issue targeted to be resolved in the 7.3.X Linux Sensor.
- There are no other workarounds
