EDR: How To Block Specific IPs For IOCs From Threat Intel Feeds From Alerting

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to block specific IPs for IOCs from threat intel feeds from alerting.

Environment

• EDR Server: All Versions

Resolution

1. Create watchlist based on threat feed.
2. Add criteria to exclude IPs for IOCs to block.
3. Enable watchlist and disable Alerts from the Threat Feed.

Additional Information

• If using the Threat Feed score as a criteria on the watchlist, the Threat Feed must remain enabled with alerts disabled.