Watchlist Alerts and tagging disabled in Carbon Black Cloud Org

Products

• Carbon Black Cloud Enterprise EDR

Issue/Introduction

Watchlist alerts/tagging disabled on an org, when they were previously enabled.

Environment

• Carbon Black Cloud Enterprise EDR

Cause

• Change in licensing (removal of EDR feature) will cause both watchlist alert and tagging to be disabled. 
• Can be confirmed via org Audit log by searching for the following:

"Enabled rule config bundles with feature"
"Disabled rule config bundles with feature"
"Disable alert generation for ALL watchlists"
"Disable document tagging for ALL watchlists"

Resolution

If this change was unexpected, please log a non-technical case with our GCA team:

https://knowledge.broadcom.com/external/article/145364/create-a-non-technical-case-for-support.html