CB ThreatHunter: Which User Role Permissions are Required to Create New Watchlists?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Which RBAC permissions are required to create new Watchlists?

Environment

• CB ThreatHunter PSC Console: All versions

Resolution

• The "Manage Third Party Watchlists" permission is required to add curated Watchlists
• The "Manage Watchlists" permission is required to add custom Watchlists

Additional Information

The following default Roles include permissions for adding Watchlists

• Level 3 Analyst
• Super Admin
• Admin - Legacy
• Live Response Admin - Legacy