This topic describes options for the Process Search Results table.

The following options appear above the Process Search Results table:

  • Show – Adjust the maximum number of search results that display on a page. The default setting is ten results per page.

  • Sort by – Sort search criteria by the following options:

    • None

    • Process last update time

    • Process start time

    • Process name

    • Network connections

    • Registry modifications

    • File modifications

    • Binary loads

  • Edit Columns – Select which columns are visible in the search results. You can also choose whether to show event counts or summary information.

  • Create Watchlist – Create a watchlist that is based on the current query string. A watchlist is a saved search that you can use to track specific IOCs. See Watchlists.

  • Export CSV – Export the first 1000 process search results to a CSV file for reporting, retention, or compliance. Each row contains a URL to access the details of each result.

  • Note:

    To export more than 1000 rows, you must configure API functionality to capture and save the data. See the VMware Carbon Black Developer Network at https://developer.carbonblack.com/reference/enterprise-response/.