Environment
- Enterprise EDR: All Versions (Formerly CB ThreatHunter)
Symptoms
- Watchlist is no longer visible in the UI
- Alerts no longer generated for watchlist
- Audit logs do not show any indication the watchlist was deleted
Cause
The watchlist was deleted and not captured in the audit log
Resolution
- A future improve to include watchlist deletes in audit logs will be completed with defect DSER-25244
- As a workaround, re-create the watchlist
Additional Notes
- Users with the ability to manage watchlists can delete watchlists created by any user
- If watchlist itself was a sub-item of a watchlist feed that was deleted, the watchlist will also be deleted
