Enterprise EDR: Investigate filemod count shows zero results despite known filemods in event

[#1]

Environment

• Enterprise EDR Console: .55 (formerly CB ThreatHunter
• Enterprise EDR Sensor: 3.5
• Microsoft Windows: All Supported Versions

Symptoms

• Searching for filemod_name returns events that show a count of 0 Filemods
• Process Analysis of the returned event shows filemods

Cause

Unknown

Resolution

If seeing this behavior, reproduce the event with the filemods on the endpoint with the following

1. Save the following as a text file on the endpoint to retain Enterprise EDR events:

{
"Version": "1.0",
"ConfigProps":
[

{ "Name": "PscEventBatchKeepLocalCopy", "Data": "True" }
]
}

2. Unlock the sensor enable changing policy:

repcli unlock <uninstall-code>

3. Load the new file as a policy

repcli addpolicy psc <full-path-to-text-file>

4. Re-create the problem event
5. Open C:\ProgramData\CarbonBlack\Events\Archives\ in explorer
6. Wait for two more .zip files to appear in this directory
7. Edit the text file to change the Data "True" value in the text file to "False"

{
"Version": "1.0",
"ConfigProps":
[
{ "Name": "PscEventBatchKeepLocalCopy", "Data": "False" }
]
}

8. Load the changed file as a policy, to turn revert changes

repcli addpolicy psc <full-path-to-text-file>

9. Capture the sensor logs and .zip files in C:\ProgramData\CarbonBlack\Events\Archives\
10. Attach captured files to a case with Support

Related Content

Carbon Black Cloud: How To Collect Sensor Logs Locally (Windows)
https://community.carbonblack.com/t5/Groups/ct-p/user-groups?case_Page=case_create