EDR: Failed to Save Ingress Filter: Request Failed with Status Code 500 When Applying to Specific Sensors

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

When creating an ingress filter for a specific sensor(s) a red toaster error displays "Failed to save ingress filter: Request failed with 500"

Environment

• EDR Console: 7.6.0 and higher

Cause

More than 1000 sensors are installed on the server and hitting the default configuration for SensorUnpagedFetchLimit

Resolution

There are two resolution options

1. Save the ingress filter as all sensors, then edit and select the specific sensor(s) again then save
2. In cb.conf, set SensorUnpagedFetchLimit to a value higher than the amount of sensors actively installed; *See additional notes

Additional Information

• SensorUnpagedFetchLimit is enabled to help the performance of the sensors page by paginating a limit of only 1000 sensors when you go to the sensors page. Depending on how many sensors have been installed to the instance, adjusting this value higher will result in performance degradation when loading the sensors page. 
• CB-43275 is open to correct this by ignoring the SensorUnpagedFetchLimit setting for the ingress filters.