Update Feed Title for CbAlerts Entries

Products

• Carbon Black EDR

Issue/Introduction

Need to update the feed title field in the Carbon Black EDR WebUI
 

Environment

• Carbon Black EDR Server: All Versions

Resolution

1. Find all alerts with the incorrect title, collecting all the unique_id's, these are a required field to make the change with SOLR:

   curl 'http://localhost:8080/solr/cbalerts/select?q=watchlist_name:%22ip%2D60461200254%22&wt=json&indent=true&rows=100&fl=unique_id,watchlist_name'

2. Create a new file in the current directory (ex: update_alerts.json)
3. Fill in the unique id's and after "set" put the correct title in place: 

   [ { "unique_id": "df8884b4-c24e-46a0-9122-78bf67d509ac", "watchlist_name": { "set": "Correct Title" } }, { "unique_id": "96093ab6-897b-442b-b6cb-d8a68e22990b", "watchlist_name": { "set": "Correct Title" } }, { "unique_id": "639432bb-00eb-4a8d-9cac-7c122ac87115", "watchlist_name": { "set": "Correct Title" } } ]

    

4. Update the alerts via the following command using @filename.json: 

   curl 'http://localhost:8080/solr/cbalerts/update' -H 'Content-type:application/json' -d @update_alerts.json

    

Additional Information

• This does not require an EDR services restart.
• A refresh of the triage alerts page in the browser is all that is needed.