CB Response: Deleted Feed Report is still visible
book
Article ID: 287951
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Deleted Feed Report is still visible in console or API
Environment
- CB Response Server: All Versions
Cause
Feed is not deleted from Solr
Resolution
- Log onto the back-end server via SSH/Terminal
- Run the following to pull the reports that have been deleted
curl "http://127.0.0.1:8080/solr/cbfeeds/select?=feed_id%3A*+AND+is_deleted%3Atrue&wt=json&indent=true"
Additional Information
- Reports with is_deleted=true can still show in the UI
- These reports are not searchable and will not alert
Feedback
thumb_up
Yes
thumb_down
No