Process Search Results Table Options

This topic describes options for the Process Search Results table.

The following options appear above the Process Search Results table:

• Show – Adjust the maximum number of search results that display on a page. The default setting is ten results per page.

• Sort by – Sort search criteria by the following options:

  • None

  • Process last update time

  • Process start time

  • Process name

  • Network connections

  • Registry modifications

  • File modifications

  • Binary loads

• Edit Columns – Select which columns are visible in the search results. You can also choose whether to show event counts or summary information.

  

• Create Watchlist – Create a watchlist that is based on the current query string. A watchlist is a saved search that you can use to track specific IOCs. See Watchlists.

• Export CSV – Export the first 1000 process search results to a CSV file for reporting, retention, or compliance. Each row contains a URL to access the details of each result.

• Note:

  To export more than 1000 rows, you must configure API functionality to capture and save the data. See the VMware Carbon Black Developer Network at https://developer.carbonblack.com/reference/enterprise-response/.