Enterprise EDR: Why Are There Continuous Watchlist Hits For The Same Watchlist?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why Are There Continuous Watchlist Hits For The Same Watchlist?

Environment

• Enterprise EDR (Formerly CB ThreatHunter) Console: All Supported Versions

Resolution

If a watchlist is only looking at metadata (e.g: process_cmdline) for a long running process, then anytime that process does anything (makes a netconn, filemod, etc), another hit will trigger

Additional Information

This is working as designed because watchlist searcher just sees a new segment with a copy of the the process metadata and the query is metadata only