Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Unexpected Watchlist Results With Suppression Enabled

Unexpected Watchlist Results With Suppression Enabled

Version

5.2.x

Issue

Watchlists containing cmdline: are returning unexpected results.

Cause

When child processes are suppressed in 5.2 their data becomes "Bundled" with the parent process data. The watchlist looking at all of the process data, including the bundled child process command line, will trigger.

Solution

Although this result is expected, as the data does indeed meet the watchlist query, you can "unbundle" the parent and child process data by disabling the suppression in the sensor groups.

This will result in the two items being separate going forward, so it will not trigger the watchlist, but it will result in more documents being created on the Carbon Black Response server, which will reduce your current retention.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎02-16-2017
Views:
679
Contributors