Tune Your Report at the IOC Level

You can take actions on the IOCs in a watchlist to suit the needs of your environment.

Important: You can only edit a Watchlist IOC if the report link is blank.

Procedure

1. Log in to the Carbon Black Cloud console and navigate to the Enforce > Watchlists screen.
2. On the main Watchlists page, click the Reports tab.
3. Locate the Name column and click the name of the report.
4. Select an IOC, click Edit and update the query if the IOC is part of a custom report, otherwise click the Take Action drop-down menu and select from the following.
   • Enable or Disable the IOC from detection.
   • Remove the IOC from the report.