CB Response Cloud: How to Delete an Ingress Filter from Windows using Powershell

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To delete an existing ingress filter for a CB Response Cloud instance from Windows using Powershell

Environment

• CB Response Cloud: All Versions
• Microsoft Windows: All Supported Versions
• Microsoft Powershell: Version 3

Resolution

1. Open Run
2. Type "powershell" and press enter.
3. Configure Powershell for TLS v1.2:

• Run within Powershell for each session:

  [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

4. Delete an existing filter:
   1. Use Invoke-RestMethod:

      Invoke-RestMethod -Headers @{"X-Auth-Token" = "<GlobalApiTokenHere>"} -Method DELETE -Uri https://<ServerHostnameHere>/api/v1/ingress_whitelist/<IngressFilterNameHere>

   2. If option A does not work then use Invoke-WebRequest:

      Invoke-WebRequest -Headers @{"X-Auth-Token" = "<GlobalApiTokenHere>"} -Method DELETE -Uri https://<ServerHostnameHere>/api/v1/ingress_whitelist/<IngressFilterNameHere>" | Select-Object -Expand Content"

Additional Information

Replace <GlobalApiTokenHere>, <ServerHostnameHere>, and <IngressFilterNameHere> with the appropriate ingress filter details.