Environment
- EDR (Formerly CB Response): All Versions
Question
Where to find info about watchlist "Newly loaded module"?
Answer
The query description is available on the watchlist page of the console.
cb.urlver=1&q=is_executable_image:false&sort=server_added_timestamp desc
Additional Notes
The watchlist will only run against newly loaded events.
