CB Response: How Are Watchlist Hits Tracked?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How are Watchlist hits tracked?

Environment

• CB Response Server: All Versions
• Clustered
• PostGres Database

Resolution

Running the following command will provide a quick overview of the 'last_hit' and 'total_hits' for each watchlist: 

psql -d cb -p 5002 -c "select name, index_type, last_hit, last_hit_count, search_timestamp, total_hits from watchlist_entries"

 

Additional Information

• In Cluster environment command should be run on Master server.
• Running the following query will contain the full contents of the 'watchlist_entries' table:

  psql -d cb -p 5002 -c "select * from watchlist_entries"