EDR: Does Ignoring Feed Future Report Also Stop Watchlist Alerting?
search cancel

EDR: Does Ignoring Feed Future Report Also Stop Watchlist Alerting?

book

Article ID: 290129

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Would selecting "ignore future report" for a feed report stop a watchlist which has a query on that feed from alerting?

For example, ignoring an IOC threat report from the SRSThreat feed while having a watchlist querying on alliance_score_srsthreat:100.

Environment

  • EDR Console: All versions

Resolution

No, "ignore future report" does not stop a watchlist from alerting.
 

Additional Information

The action is for feed alerting only. All the back-end tagging still works as normal. So watchlist would still pick it up.