CB ThreatHunter: How to build a custom watchlist from the Investigate page
book
Article ID: 290537
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Create a custom watchlist from the Investigate page
Environment
CB ThreatHunter Web Console: All Versions
Resolution
Navigate to the Investigate page
Execute a desired search query
Select Add search to Threat Report under the search magnifying glass
Under the Select a Watchlist heading in the Add Query modal, select Add New
Enter a name for the watchlist
Enter a description for the watchlist if desired
Enable Alert on Hit if the watchlist is desired to alert users when IOCs match incoming data
Selecting Include Historical Data will perform a one time query of all past data available in the console https://community.carbonblack.com/t5/Knowledge-Base/CB-ThreatHunter-How-long-is-event-data-stored-for/ta-p/72718
Enter a name for the Threat Report that will contain the search query executed previously in step 2.
Enter a description for the threat report if desired