Watchlist hit generation frequency

Products

• Carbon Black Cloud Enterprise EDR

Issue/Introduction

How frequently are Watchlist hits generated?

Environment

• Carbon Black Cloud Console: Current Versions
  • Enterprise EDR

Resolution

• Query feeds are searched every 5 minutes
• Entire history for query feeds is only searched when asked from the UI (historical search during Watchlist creation or modification)
• Query feeds are searched at ingress (instantly)

Additional Information

Currently there is no way to search ingress feeds throughout the entire history