Skip to main content

Cyware Threat Intelligence eXchange

View Watchlist Occurrences

Use the Watchlist dashboard to view your keyword entries and track their occurrences in incoming intel. Occurrences are counted only for new intel received after the watchlist is created and are not applied to existing data in Intel Exchange.

  1. From Main Menu, navigate to My Org and select Watchlist.

  2. View the following details for your watchlist entries:

    • Keyword: The item you are tracking in Intel Exchange.

    • Alert Type: Indicates how you are notified when the keyword is observed:

      • Email: Receive email notifications if you selected Enable Email Alerts.

      • System: View keyword details directly in the platform.

    • Occurrences: The number of times this item is identified in Intel Exchange. Select the record and view the details of every occurrence. Click Show Preview to see details or View in Threat Data to navigate to the threat data view.

    • Created By: The user who created the watchlist entry.

    • Created On: The date and time when the watchlist entry was created.

    • Last Activity On: The date and time of the last update to the watchlist entry.

    • Status: Toggle the status bar to make the entry active or inactive.

    • Tags: Displays all tags associated with the watchlist keyword. The watchlist automatically applies these tags to matched intel.

      Notice

      This field is available in Watchlist in Intel Exchange v3.7.5.3 onwards.

  3. To delete a record, click the three vertical dots on the right side of that entry and select Delete. If you delete a record, you will lose the data of its occurrences.

  4. To edit a record, click the three vertical dots on the right side of that entry and select Edit.

Note

Watchlist occurrences increase when a watchlist keyword appears in a key-value pair of a custom attribute. Intel Exchange counts each matching value as an additional occurrence.