EDR: Remove Ingress Filters via API

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Ability to safely remove all, or individual, ingress filters via the API.

Environment

• EDR:  Primary Servers Version 7.x

 

Resolution

• To remove all ingress filters:

curl -k -XDELETE -H "X-Auth-Token: `psql -p 5002 cb -t -c 'select auth_token from cb_user where id = '1';'`" -H "Content-Type: application/json" "https://localhost/api/v1/ingress_whitelist/$1"

• To remove an individual ingress filter:

curl -k -XDELETE -H "X-Auth-Token: `psql -p 5002 cb -t -c 'select auth_token from cb_user where id = '1';'`" -H "Content-Type: application/json" "https://localhost/api/v1/ingress_whitelist/<filter_id>"

 

Additional Information

• UI Ingress Filters were not rendering potentially due to legacy filter entries.  The filters were backed up and then marked for deletion.
• Customers can remove ingress filters themselves as opposed to requesting this from VMware Carbon Black Support.