Enterprise EDR: Watchlist disappeared

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Watchlist is no longer visible in the UI
• Alerts no longer generated for watchlist
• Audit logs do not show any indication the watchlist was deleted

Environment

• Enterprise EDR: All Versions (Formerly CB ThreatHunter)

Cause

The watchlist was deleted and not captured in the audit log

Resolution

• A future improve to include watchlist deletes in audit logs will be completed with defect DSER-25244
• As a workaround, re-create the watchlist

Additional Information

• Users with the ability to manage watchlists can delete watchlists created by any user
• If watchlist itself was a sub-item of a watchlist feed that was deleted, the watchlist will also be deleted