The settings for blocking searches with leading wildcards and searches with joins of large module cores are on the Advanced Settings tab on the Settings page. By default, both process search settings are checked, thereby blocking these searches.

Prerequisites

You must have Global Administrator (Carbon Black EDR) or Administrator (Carbon Black Hosted EDR) privileges to change these settings. In addition, if the settings are controlled by a cb.conf file configuration, they will be grayed out and unavailable for editing. In this case, see Process Search Settings in cb.conf.

Procedure

  1. Log in to as a Global Administrator or Carbon Black Hosted EDR as an Administrator.
  2. Click Username> Settings and then click Advanced Settings.
  3. Under Process Search Settings, check (or uncheck) the box for the search type to block or unblock.
  4. Click the Save changes button.