CB Response: Watchlist query missing when generated from a feed

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Watchlists created from a Threat Intelligcene Feed have a query of cb.urlver=1
• Error in job-runner logs

  • ERROR: [watchlist_search] ERROR: Required parameter 'search_query' is missing from watchlist 354 (SRSThreat Watchlist).

    
     

Environment

• CB Response Server: 6.2.3
• Linux: All Supported Versions

Cause

This is due to a know issue, CB-20781

Resolution

Upgrade to CB Response Server 6.2.4 or higher

Additional Information

Threat Intelligence Feed results can still be added to manually created watchlists