Subscribing to a Watchlist for the Carbon Black Cloud Threat Intelligence Connector

This topic describes how to subscribe a Watchlist for the Carbon Black Cloud Threat Intelligence Connector.

Example:

Usage: cbc-threat-intel create-watchlist [OPTIONS] [FEED_ID] [WATCHLIST_NAME]

  Creates a Watchlist in CBC (from already created feed)

  Example usage:

      cbc-threat-intel create-watchlist 55IOVthAZgmQHgr8eRF9rA STIXWatchlist

      cbc-threat-intel create-watchlist 55IOVthAZgmQHgr8eRF9rA STIXWatchlist
      -d description -e -t -q

Arguments:
  [FEED_ID]         The watchlist will subscribe from that feed
  [WATCHLIST_NAME]  The name of the watchlist

Options:
  -d, --description TEXT  The description of the watchlist  [default: empty]
  -e, --enable-alerts     Whether alerts should be enabled for this watchlist
  -q, --quiet             This will only print the id of the created feed.
  -c, --cbc-profile TEXT  The CBC Profile set in the CBC Credentials
                          [default: default]
  --help                  Show this message and exit.

Based on the preceding example, you must be aware of the following parameters before you create the Watchlist.

Option or Argument	Default	Description
FEED_ID	String, Required	The Watchlist will subscribe from this feed
WATCHLIST_NAME	String (URL), Required	The name of the Watchlist
--description (-d)	String (“empty”)	The description of the Watchlist
--enable-alerts (-e)	Boolean (False)	Determines whether alerts should be enabled for this Watchlist
--cbc-profile (-c)	String (“default”)	The Carbon Black Cloud Profile set in the Carbon Black Cloud Credentials
--quiet (-q)	Boolean (False)	Only prints the ID of the created feed