CB Response: No hits on watchlist that uses the "&" special character

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Watchlists that use the "&" special character in the SOLR query return no results.

Environment

• CB Response Server: 6.4.0 and Lower

Cause

The watchlist modal cannot interpret the special character, thus the query fails.

Resolution

1. Upgrade to 6.4.1-srv version of the CB Reponse server to apply the fix.
2. The workaround is to use "%26" instead of "&" in the watchlist modal for terms that have the special character.