CB Response: Deleted Feed Report is still visible

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Deleted Feed Report is still visible in console or API

Environment

• CB Response Server: All Versions

Cause

Feed is not deleted from Solr

Resolution

1. Log onto the back-end server via SSH/Terminal
2. Run the following to pull the reports that have been deleted

   curl "http://127.0.0.1:8080/solr/cbfeeds/select?=feed_id%3A*+AND+is_deleted%3Atrue&wt=json&indent=true"

Additional Information

• Reports with is_deleted=true can still show in the UI
• These reports are not searchable and will not alert