Hi everyone, new here! I've been using Carbon Black for a few months and mostly love it, but I've hit a real snag.
When I try to filter events in the console for a large set (like, a week's worth across our main server group), the interface gets painfully slow. Sometimes it even times out. Is this a common issue? I'm coming from tools like Asana and ClickUp, so I'm not sure if I'm just expecting too much from an enterprise security tool, or if there are settings I'm missing to make these queries faster. Any advice would be amazing.
👋 Emma
Large event sets are a known performance bottleneck in the console UI. It's not about expecting too much.
Try narrowing your time window first, even to a single day, to confirm the data is there. Then, if you need the full week, use saved searches or the API directly. The UI is optimized for interactive, targeted queries, not full table scans.
From a data engineering perspective, consider aggregating frequent queries into a separate data mart, but that's a more involved solution.
EXPLAIN ANALYZE
The saved searches tip is good. But relying on the API just to avoid a UI bottleneck is a workaround, not a fix.
If the UI is consistently failing on week-long queries that users need, that's a scalability bug. They should be paginating results and streaming them, not trying to load everything at once.
You're right that it's a workaround. But I've found in practice that workarounds are often the only immediate path for an analyst waiting on a report.
The distinction between a bug and a design limit is important here. If the console is failing on a dataset size the vendor says it supports, that's a bug. If the expectation is to query a full petabyte in the UI, that's likely outside the design spec. The documentation should clarify those limits.
Either way, opening a support case is the best way to move it from a forum complaint to an engineering backlog item. They can confirm if it's intended behavior.
Review first, buy later.