EDR: Negation of Some Binary Term Searches May Provide Inaccurate Results in EDR 7.7.x
EDR Servers: 7.7.2 to 7.8.0
Searches using some binary terms (digsig_publisher or file_desc) combined with negation of a term group containing spaces may return inaccurate results. Other binary search terms, such as md5, work as expected. Examples:
digsig_publisher:M* and –group:”Default Group”
file_desc:M* and -(group:"Research Network")
Still under investigation.
The fix is expected in EDR Server 7.8.1.
Potential workaround: Confirm results by determining the total (without negation) then subtract the search results using positive terms.
For example using the same timeframe:
Search 1: digsig_publisher:M*
Search 2: digsig_publisher:M* and (group:”Group1” or group:”Group2”)
Removing the results in search 2 from search 1 provides the correct results.