EDR: Process Analysis shows fewer events than listed in Process Search results

[#1]

Environment

• EDR Server: 6.x and Higher

Symptoms

• The number of events shown on the Process Analysis page does not match the number of events associated with the process in search results.
• Events associated with an alert do not appear in the Process Analysis page

Cause

• Minor discrepancies are caused by the Fuzzy Facets feature which returns an estimated guess of each event count
• Numbers off by hundreds or thousands of events are caused by a limit on the number of events per page returned in Process Analysis

Resolution

1. To view all events of a process, the timeline on the Process Analysis page must be fully expanded
2. Each page contains a predetermined set of 500 events, to view other events in the process, click through each page

Additional Notes

Feature Request has been created to allow the ability for searching all pages of events in the Process Analysis page:
https://community.carbonblack.com/t5/Idea-Central/Search-all-pages-of-an-Event-in-the-Process-Analys...

Related Content

• Cb Response: Filtering in Process Analysis returns several empty Event pages
• Cb Response 6.1.0 Release Notes - p. 22 covers Process Analysis Page and Timeline