CB Response: How Are Watchlist Hits Tracked?
search cancel

CB Response: How Are Watchlist Hits Tracked?

book

Article ID: 290454

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How are Watchlist hits tracked?

Environment

  • CB Response Server: All Versions
  • Clustered
  • PostGres Database

Resolution

Running the following command will provide a quick overview of the 'last_hit' and 'total_hits' for each watchlist: 
psql -d cb -p 5002 -c "select name, index_type, last_hit, last_hit_count, search_timestamp, total_hits from watchlist_entries"

 

Additional Information

  • In Cluster environment command should be run on Master server.
  • Running the following query will contain the full contents of the 'watchlist_entries' table:
    psql -d cb -p 5002 -c "select * from watchlist_entries"