The Anomaly Classification feature is deactivated by default. Use the following procedure to turn on the Anomaly Classification feature for either the Carbon Black Cloud Advanced Threats Watchlist or the AntiMalware Scan Interface (AMSI) Threat Intelligence Watchlist.


  1. On the left navigation pane, click Enforce > Watchlists.
  2. Click one of the following watchlists:
    • Carbon Black Cloud Advanced Threats
    • AMSI Threat Intelligence
    Anomaly Classification feature turned off
  3. Click Take Action and select Edit from the drop-down menu.
    Edit Watchlist pane
  4. Select the Alert on hit check box.
  5. Select the Classify anomalies check box.
  6. Click Save.