Group alerts to view similar alerts occurring across multiple endpoints in a single row.

Note: By default, alerts are automatically set to Group by: None.

In the Group By: None view, all alerts are displayed individually in a single alert row, even if an alert is seen on multiple devices.

You can identify alert prioritization and determine when actions need to be taken on an individual alert.

Use the Group By drop-down menu in the top right of the table to group all alerts with the same threat ID. See: Group By: Threat ID.

Note: For Carbon Black Cloud Managed Threat Hunting customers only, the Carbon Black Managed Detection and Response badge and the Carbon Black Managed Detection and Response triage column are not available in the grouped alerts view.

Type/Reason Column

The Type/Reason column determines the threat ID of the alert and explains why the alert was created.

Threat ID groups include:

  • Watchlist
  • CB Analytics
  • USB
  • Host-Based Firewall
  • Containers Runtime
  • IDS

Workflow Column

The Workflow column indicates whether an alert is open or closed.

Click the status of the alert in the Workflow column to view:

  • The Alert ID
  • The user that updated the workflow status and the timestamp
Note: The workflow column is only interactive on a single alert. You cannot click the workflow status of grouped alerts.