EDR: SRS Threat Feed Creating Many Alerts
search cancel

EDR: SRS Threat Feed Creating Many Alerts

book

Article ID: 285730

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

SRS Threat feed is creating many feeds starting on 9/15/2020

Environment

  • EDR Server: All Versions

Cause

An update to the feed was made some systems that sent in incorrect dates into Alliance. 

Resolution

No steps needed by the consumer. 

Additional Information

  • Systems seeing this at one point sent in an incorrect timestamp and now feeds reports are updating correctly
  • Because some systems sent in incorrect timestamps, they may not get updated with threat reports and an alert could be missed. A manual adjustment within Alliance to correct these timestamps was made to make sure alerting is continuing
  • Once the feeds have fully synchronized and run, the alerts will quiet down.