CB Response: Watchlist is Hitting Some But Not All the Qualified Watchlist Hits

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

A watchlist is recording hits but some behavior that should be hitting the watchlist doesn't get hit

Environment

CB Response: 6.1.x and Higher

Cause

Watchlists have a maximum of 100 hits by default

Resolution

1. While logged in as root user 
2. Edit the /etc/cb/cb.conf file
3. Add WatchlistSearchMaxTags=<Value>
4. Save the settings 
5. Restart the services following this

Additional Information

• If watchlists are getting more hits than this, then it's recommended to narrow down the behavior they monitor
• This value can be increased but it's not recommended to go past 200 
• The watchlist will only hit once on the same running process for the same behavior in order to limit noise