Watchlist Does not Alert on the Same Process with New Matching Activity

Products

• Carbon Black EDR

Issue/Introduction

When running the same query in the process search page, there is only one alert for a process that matches the query multiple times. 

Environment

• Carbon Black EDR Console: All Versions

Resolution

This is working as designed. 

A watchlist should only tag a process once and send an alert. Because an alert already exists for the process, the first alert triggers the investigation for that process. This help to not only reduce the noise caused by alerts, but also avoid a re-investigation of a unique process that was already reviewed. 

Additional Information

• In rare cases a watchlist can tag an process more than once. This is generally long running processes or processes that happen to fall between a core rollover. Solr searches cores individually, if the tag does not exist on the current writer core the watchlist could tag the same process again.