EDR: Why do watchlist shows expired?
search cancel

EDR: Why do watchlist shows expired?

book

Article ID: 290704

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why watchlist shows expired?

Environment

  • EDR Server: 6.2.3+

Resolution

Expired watchlists should behave in every way like regular watchlists as long as they continue to be enabled. Expired just means it hasn't gotten any hits in x period of time, where x can be configurable on a per-user basis.