Environment
- EDR Server: All Versions
- Hosted EDR Server: All Versions
Symptoms
Processes which are terminated:true are not consistently returned when netconn_count is used in process search.
Cause
This is due to a product issue.
Resolution
The product issue is being investigated in CB-32829. Once a target release date or version is provided, this article will be updated.
Additional Notes
Example:
1. The following search returns 29 hits, all of which have a terminated:true in process document:
netconn_count:[1 TO *] ipaddr:127.0.0.1 process_name:local
2. However this search returns 12 results:
netconn_count:[1 to 100] ipaddr:127.0.0.1 process_name:local
