EDR: Why are CbFeeds Better than Watchlists for a List of Hashes, IPs, or Domains?
book
Article ID: 287962
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Why are cbfeeds better than creating a watchlist for a list of hashes, ips or domains?
Environment
EDR Server: All Versions
Resolution
IOC based feeds (outside of query) run at ingress and have a better chance of alerting you faster than a watchlists running every 10 minutes
Copying and pasting a list of IOCs has a high probability of capturing line feeds (%A0) after each entry, this can cause Solr to search across each file type for every entry, especially when md5: for example is not in front of each
Overall management, it's much easier to add, update and delete a feed with a large list of IOC's than a watchlist
A score can be added to each individual report, making alerts easier to take action on by severity