EDR: Does Ignoring Feed Future Report Also Stop Watchlist Alerting?
book
Article ID: 290129
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Would selecting "ignore future report" for a feed report stop a watchlist which has a query on that feed from alerting?
For example, ignoring an IOC threat report from the SRSThreat feed while having a watchlist querying on alliance_score_srsthreat:100.
Environment
- EDR Console: All versions
Resolution
No, "ignore future report" does not stop a watchlist from alerting.
Additional Information
The action is for feed alerting only. All the back-end tagging still works as normal. So watchlist would still pick it up.
Feedback
thumb_up
Yes
thumb_down
No