Cb Response: Cannot save a watchlist query when using the & character

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Error appears if saving a new watchlist with & character
• Anything before the & is saved, everything else is stripped from the query

Environment

CB Response Server: 6.4.x and before

Cause

This issue has been identified as a known issue with the ID CB-23654. Fixed in 6.5.0

Resolution

There are two options to resolve this.

1. For pre-6.5.0 instances create the watchlist from the search page
2. For 6.5.0 and above, the ampersand should be between single or double quotes. 

Additional Information

• For workaround 1. The watchlist is not valid to be edited after, it will fail as per the original issue. Delete the watchlist and recreate via the process search page with the edits