Environment
- Carbon Black Cloud Console
- Carbon Black Cloud "Unified Platform Experience" .
Question
Why does running the following Elsie query returns no results?
process_cmdline:DownloadString
But the following pre- Elsie query will return results:
downloadstring
Answer
Wildcards are needed for the search to correctly parse the command line.
Replace
process_cmdline:DownloadString
with
process_cmdline:*DownloadString*
Related Content
