Enterprise EDR: How to build a custom watchlist from the watchlists page

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Build a custom watchlist by combining individual threat reports from multiple sources

Environment

• Enterprise EDR Console: All Versions

Resolution

1. Click Enforce, then Watchlists
2. Click Add watchlists, then select Build
3. Select reports you want to add to a watchlist, then click Add. Use search and filters to find reports by attribute (e.g., IOC, source).
4. Select an existing watchlist or create a new watchlist, then click Add.