CB ThreatHunter: Search links in Watchlist Notification emails not returning results

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Notification email contains link to Investigate page with a search which returns no results
• Search references device_id and alert_id
• Using same search on Alerts page returns results

Environment

• Predictive Security Cloud (PSC): All Versions
  • CB ThreatHunter
• Notification(s) configured for Watchlist hits

Cause

Under investigation for root cause and potential solutions

Resolution

Follow this KB article for updates on resolution or potential workarounds

Additional Information

If you experience this issue, please open a case with Carbon Black Technical Support

Information to provide to Support

• Copy of Notification email and plaintext search from Investigate page
• Uncropped screenshot showing search results on Investigate page
• Uncropped screenshot showing search results on Alerts page
• Name of Watchlist and Report which triggered the Notification