You can configure Carbon Black EDR to notify you when a watchlist has not received any hits over a specified period of time. This might be a sign that the watchlist is not useful and can be deleted, or perhaps that the query in the watchlist must be modified to be effective.

Watchlist expiration is informational only. When a watchlist expires, you are prompted to take action on it, but it is still fully functional unless you delete or disable it.

A single watchlist expiration configuration applies to all watchlists.

Procedure

  1. On the navigation bar, click Watchlists.
  2. Click Configure Expiration.
    The configure watchlists expiration
  3. By default, watchlists are marked as Expired if they have received no hits over a six-month period. To use a different time period for expiration or to reconfigure a watchlist page that had expiration turned off:
    1. Make sure the Notify me when watchlists have not received hits in radio button is selected.
    2. Enter a number in the box and select the units (days, months, or years).
  4. If you do not want any watchlists to be designated as expired, click the radio button that reads Do not mark watchlists as expired if they have no hits.
  5. Click Save Configuration.