Process Search Settings in cb.conf

Two settings in the cb.conf file affect whether process searches with possibly significant performance impact are blocked, allowed, or configurable through the console.

• ForceBlockLeadingWildcardsInSearchTo (interacts with Block Searches with Leading Wildcards in the console).

• ForceBlockCoreJoinsInSearchTo (interacts with Block Searches that included Binary Metadata with Large Binary Stores in the console).

By default, neither of these settings are present in the cb.conf file.

If a setting is True, process searches in the relevant category are blocked, and no user, including a Global Administrator, can change this setting through the console.

If a setting is False, process searches in the relevant category are allowed, and no user, including a Global Administrator, can change this setting through the console.

A third setting in cb.conf , ModuleCoreDocumentCountWarningThreshold , sets the number of module core documents that is considered large enough to be blocked when Block Searches that included Binary Metadata with Large Binary Stores is activated. By default, this setting has a value of ten million.

See the Carbon Black EDR Server Configuration Guide for information about editing cb.conf.