@crahan Can you provide the sample code you are using to execute this query? Additionally are you using your PR with the new process search v2 routes?

Hi,

The above findings are for the v1 search with the below sample script (and without the v2 search PR applied):

from cbapi.psc.threathunter import CbThreatHunterAPI
from cbapi.psc.threathunter.models import Event, Process

cb = CbThreatHunterAPI(profile='profile-name')

query_result = cb.select(Process).where('process_guid:ORGKEY-011e05ee-0000044c-00000000-1d648aca4504395')

for process in query_result:
    print(process)

Depending on the process search result being enriched or not enriched the output is as described above. When I run this with the changes from the v2 search API I do get an internal and an external IP address for the single process search result from the above script (as the v2 search API aggregates all enriched process information for a specific process GUID into a single object). I've run the above script 3 times with the v2 changes and while the device record in the UI still reports the IP information similar to the above UI screenshot, the result from the above sample script were different for each run:

Run 1

       backend_timestamp: 2020-07-07T08:36:34.203Z
         childproc_count: 56
         crossproc_count: 233
      device_external_ip: 4-REDACTED-1 (a not before seen public IP address 1)
            device_group: mss-windows-test
         device_group_id: 17984
               device_id: 18744814
      device_internal_ip: 1-REDACTED-8 (a not before seen public IP address 2)
             device_name: REDACTED-x1
               device_os: WINDOWS

Run 2

       backend_timestamp: 2020-07-07T09:05:01.263Z
         childproc_count: 56
         crossproc_count: 237
      device_external_ip: 6-REDACTED-8 (same public IP as noted in the initial issue description)
            device_group: mss-windows-test
         device_group_id: 17984
               device_id: 18744814
      device_internal_ip: 6-REDACTED-8 (same public IP as noted in the initial issue description)
             device_name: REDACTED-x1
               device_os: WINDOWS

Run 3

       backend_timestamp: 2020-07-07T09:05:01.263Z
         childproc_count: 56
         crossproc_count: 237
      device_external_ip: 6-REDACTED-8 (same public IP as noted in the initial issue description)
            device_group: mss-windows-test
         device_group_id: 17984
               device_id: 18744814
      device_internal_ip: 4-REDACTED-1 (the same public IP 1 from the first run)
             device_name: REDACTED-x1
               device_os: WINDOWS

v2 API run 1: both IP addresses are different from what is reported in the device record in the UI.
v2 API run 2: both IP fields are set to the public IP address reported in the device record in the UI.
v2 API run 3: the external IP address matches what is reported by the device record in the UI and the internal IP address has changed back to the random external IP address from run 1.

It does not appear that the v2 search API resolves this issue, except for the device_external_ip and device_internal_ip fields always being present. For run 2 and 3 the backend_timestamp is even the same, but the IP info is not. I've run the same script (with the same GUID) a couple more times, and IP address information just keeps changing in between runs.

This item is being tracked through an EA for backend teams to triage the API service