Enterprise EDR: Error Creating Threat Report "Search fields are required to add queries to a watchlist report. To learn more, see the Search Guide"
book
Article ID: 290139
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
The following error is observed when selecting Add search to threat report on the investigate page
Search fields are required to add queries to a watchlist report. To learn more, see the Search Guide
Investigate page search query contains special characters
Environment
Enteprise EDR Web Console: All Versions
Cause
This issue is caused by improperly escaped special characters in a search query
Resolution
Ensure search queries are properly escaped. More information on special characters and escaping can be found in the Advanced search tips for CBC Platform Search article linked in the Related Content section