You can view and act upon events and netconn data on the Observations tab of the Investigate page. This page is visible for Carbon Black Cloud Endpoint Standard customers and for Carbon Black Cloud Enterprise EDR customers who also have VMware Carbon Black XDR.

Tip: This section provides a general description of the Observations page. For information about XDR-specific data, see Exploring XDR Data on the Observations Page.

On the left navigation pane, click Investigate and click the Observations tab.

Note: If you do not see the Observations tab, toggle New Investigate experience ON on the Enriched Events tab. You can toggle back to the Enriched Events tab at any time.
Image of Observations tab on the Investigate page