CB ThreatHunter: Successful Query Returns "Search Fields are Required" Message When Saving as a Threat Report
search cancel

CB ThreatHunter: Successful Query Returns "Search Fields are Required" Message When Saving as a Threat Report

book

Article ID: 288892

calendar_today

Updated On:

Products

Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • A query on on the Investigate page successfully runs and return results
  • Clicking on the "Add search to threat report" link results in the following message
    Search fields are required to add queries to a watchlist report. To learn more, see the search guide.

Environment

  • CB ThreatHunter PSC Console: March '19 release and later

Cause

This is expected behavior because Threat Reports require all search terms to include a field name (such as process_name, process_cmdline, etc.)

Resolution

  1. Check the query for any search terms that do not include a field name
  2. Add the missing field names
  3. The query can now be saved as a Threat Report

Additional Information

  • Value Search was added in the March PSC release, which added the ability to perform searches across all fields for a given term without designating a specific field
  • Threat Reports still require a specified field for each search term
  • It only takes one missing field name to prevent saving as a Threat Report
  • A successful query cannot always be saved as a Threat Report due to this distinction