CB ThreatHunter: Error retrieving hits for watchlist(s)

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Error retrieving hits for watchlist(s) can be seen on the watchlists page
• Watchlists will display a loading wheel in the hits column that does not resolve

Environment

• CB PSC Console: All Versions
  • CB ThreatHunter
• CB PSC Sensor: All Supported Versions

Cause

This issue can be caused by one of two factors, or both:

1. There is no data present in the console for the past 3 days
2. There are only unsupported CB ThreatHunter sensors deployed in the environment e.g. PSC Linux sensor version 2.2.0.127

Resolution

• Validate the deployed sensors are submitting data from within the previous 3 days
• Validate the deployed sensors are supported on the CB ThreatHunter platform

Additional Information

• A future product enhancement will alter the "Error retrieving hits for watchlist(s)" banner message to better reflect when no data is available
• Status of "400" may be seen in the UI or within a HAR capture.