Enterprise EDR: Watchlist Alert ID does not match Alert ID on Investigate page

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Watchlist Alert IDs display the following format on the Alerts page:
  • {ORG_KEY}-00e23c7b-000013b4-00000000-1d5df61ab230d55-CFnKBKLTv6hUkBGFobRdg-565577
• Investigating a Watchlist Alert from the Alerts page will populate an Alert ID on the Investigate page in a similar format as below:
  • 2DC13D9D9EFEEC70B30D51CC7F1E3E97

Environment

• Enterprise EDR Web Console: All Versions

Cause

The cause of this behavior is due to the architecture of the product in its current state

Resolution

VMware Carbon Black engineering is investigating a possible resolution to align Watchlist Alert IDs on the Alert and Investigate pages