Cb Response: Cannot save a watchlist query when using the & character
book
Article ID: 285770
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Error appears if saving a new watchlist with & character
Anything before the & is saved, everything else is stripped from the query
Environment
CB Response Server: 6.4.x and before
Cause
This issue has been identified as a known issue with the ID CB-23654. Fixed in 6.5.0
Resolution
There are two options to resolve this.
For pre-6.5.0 instances create the watchlist from the search page
For 6.5.0 and above, the ampersand should be between single or double quotes.
Additional Information
For workaround 1. The watchlist is not valid to be edited after, it will fail as per the original issue. Delete the watchlist and recreate via the process search page with the edits