Enterprise EDR: Is There A Way To Tell Which Component Of An IOC Triggered An Alert?

[#1]

Environment

Enterprise EDR (Formerly CB ThreatHunter) Web Console: All Versions

Question

Is There A Way To Tell Which Specific Component Of An IOC Triggered An Alert?

Answer

No. Currently there is no way to tell which component(s) were responsible, only the name of the IOC involved

Additional Notes

A feature request has been added over in 'Idea Central' on the UeX, at the following link. Please feel free to vote on this...

Enterprise EDR: Add the ability to determine which component of an IOC triggered an alert

Related Content

CB ThreatHunter: What watchlist types are currently available?
CB ThreatHunter: How to add queries to watchlists from the Investigate page
CB ThreatHunter: How to build a custom watchlist from the watchlists page