EDR: Where to find info about watchlist "Newly loaded module"?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Where to find info about watchlist "Newly loaded module"?

Environment

• EDR (Formerly CB Response): All Versions

Resolution

The query description is available on the watchlist page of the console.

cb.urlver=1&q=is_executable_image:false&sort=server_added_timestamp desc

 

 

Additional Information

The watchlist will only run against newly loaded events.