How to Execute an Immediate Full Feed Sync

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Execute an immediate Threat Intelligence feed sync to download latest threat intelligence for all feeds.

Environment

• EDR Server:  All versions
• Linux OS: All Supported Versions

Resolution

• For EDR Server Version 6.2.2 and Higher the "Sync all" option is available on the Threat Intelligence page under Actions menu
• For EDR Server Version 6.2.1 and Lower execute as root (master only on a cluster):

/usr/bin/python -m cb.maintenance.job_runner --master -s feed_sync --full-sync

 

Additional Information

• Replace "-s" with "-vvv" in the commands when verbose output is required for validation.  Using "-s" will generate a silent feed sync, while "-vvv" will generate verbose feed sync output. 
• If there are errors faced using the sync all option, there may be command options however utilizing the console should be the first option