EDR Historical Search takes excessive time for processing and responding

Technical Articles ID: KB93415
Last Modified: 2023-07-03 04:30:21 Etc/GMT

Environment

Endpoint Detection and Response (EDR)

Problem

EDR Historical Search takes excessive time for processing and responding.

Solution

NOTE: Any future product functionality or releases mentioned in the Knowledge Base are intended to outline our general product direction and should not be relied on, either as a commitment, or when making a purchasing decision.
Engineering is aware of this issue. A fix will be delivered in a future release.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Workaround

To avoid delays when using Historical Search, follow one or more of the following best practices:

Narrow the search to the last 4 or 24 hours.
This window keeps the response times low and returns a smaller dataset.
Reduce or eliminate use of the exclude filter.
If the target of a query is known, use the include filter and adjust the time frame to only the period needed.
If you're investigating an event that occurred outside the 24-hour window:
1. Navigate to the Monitoring Workspace.
2. Select the threat from the left-side panel.
3. In the Device section, select the device to investigate.
4. Pivot to Historical Search from using the Show historical device trace for %device% by clicking the three dots menu next to the device name.
  This way Historical Search loads information available for the device in the time frame in which the event occurred.
5. In Historical Search, narrow the time frame to 4 h before - 4 h after
If you're in an Investigation and the event occurred outside the 24-hour window:
1. Navigate to the Investigating Workspace.
2. Select the Investigation.
3. From the Graph view, select the device.
4. Select the device.
5. Pivot to Historical Search from using the "Show historical device trace for %device%" by clicking the three dots menu next to the device name.
  This way Historical Search loads information available for the device in the time frame in which the event occurred. It's recommended to select "4 h before - 4 h after".
6. In Historical Search, narrow the time frame to 4 h before - 4 h after.

Knowledge Center

EDR Historical Search takes excessive time for processing and responding

Environment

Problem

Solution

Workaround

Affected Products

Title

Title

Knowledge Center

EDR Historical Search takes excessive time for processing and responding

Environment

Problem

Solution

Workaround

Affected Products

Choose your region

Title

Title