EDR: How to get watchlist added time, watchlist name and if enabled or not
search cancel

EDR: How to get watchlist added time, watchlist name and if enabled or not

book

Article ID: 288611

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to get watchlist added time, watchlist name and if enabled or not

Environment

  • EDR all versions

Resolution

  • Run below query on the stand alone or master server.
psql -d cb -p 5002 -c "Select date_added,name,enabled from watchlist_entries;" >>/tmp/watchlists.csv

 
Powered by Wolken Software