EDR: Watchlists not generating alerts

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Watchlists are no longer generating alerts

Environment

• EDR: 6.x and Higher

Cause

Watchlists stopped generating alerts and sensors were found to have stopped checking into the instance

Resolution

Check licence expiry date on SFDC for customer installation record to determine if it has exceeded the 30 day renewal period.

Additional Information

There is a 30 day grace period added to the license expiration date before EDR Server begins rejecting events uploaded from sensor.