CB ThreatHunter: Error retrieving hits for watchlist(s)
search cancel

CB ThreatHunter: Error retrieving hits for watchlist(s)


Article ID: 285389


Updated On:


Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)


  • Error retrieving hits for watchlist(s) can be seen on the watchlists page
  • Watchlists will display a loading wheel in the hits column that does not resolve


  • CB PSC Console: All Versions
    • CB ThreatHunter
  • CB PSC Sensor: All Supported Versions


This issue can be caused by one of two factors, or both:
  1. There is no data present in the console for the past 3 days
  2. There are only unsupported CB ThreatHunter sensors deployed in the environment e.g. PSC Linux sensor version


  • Validate the deployed sensors are submitting data from within the previous 3 days
  • Validate the deployed sensors are supported on the CB ThreatHunter platform

Additional Information

  • A future product enhancement will alter the "Error retrieving hits for watchlist(s)" banner message to better reflect when no data is available
  • Status of "400" may be seen in the UI or within a HAR capture.