CB ThreatHunter: How to favorite a search query on the Investigate page

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Mark a search query on the investigate page as a favorite

Environment

• CB ThreatHunter Web Console: All Versions

Resolution

1. Navigate to the Investigate page
2. Enter the desired query in the search bar
3. On the far right of the search bar select the Star icon
4. Enter a unique name for the favorite query
5. Set the permission level
   • Private indicates only the user who created the query can view the favorite
   • Org-wide indicates any user with the appropriate permissions to investigate in the console can view the favorite
6. Select Save