Turn on Anomaly Classification

The Anomaly Classification feature is deactivated by default. Use the following procedure to turn on the Anomaly Classification feature for either the Carbon Black Cloud Advanced Threats Watchlist or the AntiMalware Scan Interface (AMSI) Threat Intelligence Watchlist.

Procedure

1. On the left navigation pane, click Enforce > Watchlists.
2. Click one of the following watchlists:
   • Carbon Black Cloud Advanced Threats
   • AMSI Threat Intelligence
   
3. Click Take Action and select Edit from the drop-down menu.
   
4. Select the Alert on hit check box.
5. Select the Classify anomalies check box.
6. Click Save.