CB ThreatHunter: What happens to pre-existing CB Defense Data when an org is converted to ThreatHunter?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What happens to the pre-existing data on a CB Defense Org when it is converted to ThreatHunter?

Environment

• CB Defense Web Console: All Versions
• CB ThreatHunter: All Versions

Resolution

The processed data is pulled over from the CB Defense pipeline and injected at the first stage of the CB ThreatHunter processing/analysis pipeline.

Additional Information

During the conversion, if any Defense event matches a ThreatHunter Watchlist IOC, a hit and/or alert will be generated for it.