How to Add Queries to Watchlists From the Investigate Page

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Integrate unique threat intelligence by adding custom queries to watchlist reports

Environment

• Carbon Black Cloud Console: All Versions

Resolution

1. Navigate to the Investigate page
2. Execute the desired query in the search bar
3. Verify the results are what is expected
4. Select Add search to Threat Report under the search magnifying glass
5. Select an existing custom Watchlist or create a new custom Watchlist
6. Add the search query to an existing Threat Report or create a new Threat Report
7. Select Save