- Get Started with Threat Center
- Threat Center
- Threat Center Permissions
- Threat Center Alerts: Read
- Threat Center Alerts: Read, Write, and Delete
- Threat Center Cases: Read
- Threat Center Cases: Read, Write, and Delete
- Threat Center Detection Grouping Rules: Read
- Threat Center Detection Grouping Rules: Read, Write, and Delete
- Threat Center Watchlist: Read
- Threat Center Watchlist: Read, Write, and Delete
- Threat Center Cases
- Threat Center Alerts
- Threat Center Detections
- Threat Center Risk Score
- Monitor Entities of Interest in Threat Center
- Group Detections
- Work on Cases
- Work on Alerts
- Edit and Collaborate in Threat Center
- Use Automation Tools in Threat Center
- Find Cases and Alerts
- Sort Cases or Alerts
- Filter Cases or Alerts
- Search for Cases or Alerts in Threat Center
- Build a Search in Threat Center
- Enter a Search Using Exabeam Query Language in Threat Center
- Enter a Search Using Natural Language in Threat Center
- Run a Recent Search in Threat Center
- Create a New Saved Search in Threat Center
- Run a Saved Search in Threat Center
- Edit a Saved Search in Threat Center
- Delete a Saved Search in Threat Center
- View Case and Alert Metrics
- Get Notified About Threat Center
- Threat Center APIs
Pre-Built Watchlists
Fully pre-configured watchlists are ready to help you monitor entities of interest without you having to create your own watchlists.
Pre-built watchlists are watchlists that are already configured and ready for you to use. They're listed along your custom watchlists on the Overview tab. There are five pre-built watchlists:
Notable Users – User entities that have had a risk score of 90 or above during the selected time frame.
Notable Assets – Device entities that have had a risk score of 90 or above during the selected time frame.
Executive Users – User entities with the Executive label.
Privileged Users – User entities with the Privileged User label.
Service Accounts – Device entities with the Service Account label.
You can edit and delete the Executive Users, Privileged Users, and Service Accounts pre-built watchlists. You can't edit or delete the Notable Users and Notable Assets pre-built watchlists.
If you don't want to use pre-built watchlists, create your own watchlist.