Watchlists can be unsubscribed Feeds cannot be/do not need to be unsubscribedįeeds are in effect “potentially-subscribable Watchlists”.

Watchlists are specific to one organization Feeds can be published to one, some or all organizations.

Watchlists generate Hits and Alerts in your organization Feeds do not.

What are the functional differences between Feeds and Watchlists?

The Watchlist as a whole can be unsubscribed or disabled.

Existing Reports in that Watchlist can be disabled or enabled.

Once created, a Watchlist can be edited in one of three ways:

Watchlists can be subscribed from a Feed, or can be created directly from a selection of existing Reports. On the Carbon Black Cloud, a Watchlist is a specific set of subscribed Reports and their IOCs that are evaluated against incoming sensor data to enrich your search results with “hits” where the Watchlists found a match in your endpoint fleet’s events data.

In the Carbon Black Cloud console, Feeds are those Watchlists whose Type is “F” (Feed Subscription). Private Feeds can be created in anyone with sufficient privileges in the target organization.Reserved Feeds can be created in another organization only by MSSPs.Public Feeds can only be created or edited by VMware Carbon Black more information about the current public Feeds can be found on the Carbon Black User Community here.It is also possible to publish a Feed to only one organization (private), but in practice this is unnecessary overhead for most organizations: On the Carbon Black Cloud, a Feed is a collection of actionable threat intelligence, organized into Reports which are collections of one or more Indicators of Compromise (IOCs).įeeds can be published to all organizations in an environment (public) or to a selection of managed organizations in an environment (reserved). The Feed Manager API enables you to manage third-party threat intelligence Watchlists (here called “Feeds”), including the ability to convert Carbon Black EDR queries for use in Carbon Black Cloud Enterprise EDR. Carbon Black Cloud Enterprise EDR (Endpoint Detection and Response) is the new name for the product formerly called CB ThreatHunter.

Alienvault otx feed subscribe