Enterprise EDR: How to build a custom watchlist from the watchlists page
search cancel

Enterprise EDR: How to build a custom watchlist from the watchlists page

book

Article ID: 290269

calendar_today

Updated On:

Products

Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Build a custom watchlist by combining individual threat reports from multiple sources

Environment

  • Enterprise EDR Console: All Versions

Resolution

  1. Click Enforce, then Watchlists
  2. Click Add watchlists, then select Build
  3. Select reports you want to add to a watchlist, then click Add. Use search and filters to find reports by attribute (e.g., IOC, source).
  4. Select an existing watchlist or create a new watchlist, then click Add.