EDR: Why is the Alert Count Lower After Upgrading to 7.3.0 Server?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

EDR: Why is the Alert Count Lower After Upgrading to 7.3.0 Server?

Environment

EDR Console: 7.3.0 or Higher

Resolution

With the upgrade from 7.2.0 or lower to 7.3.0 or higher, the cbalerts core is purged of alerts older than 90 days to reduce the overall upgrade time

Additional Information

• User Exchange Announcement https://community.carbonblack.com/t5/Endpoint-Detection-and-Response/Solr-8-Upgrade-Release-Announcement/m-p/95093#M4735
• 7.3.0 introduces Solr 8. In order to upgrade to this version, the cores need to be re-indexed and can result in hours of upgrade time without reducing this core. The cbalerts core is not purged on normal operation.