CB Response: Deleted Feed Report is still visible
search cancel

CB Response: Deleted Feed Report is still visible

book

Article ID: 287951

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Deleted Feed Report is still visible in console or API

Environment

  • CB Response Server: All Versions

Cause

Feed is not deleted from Solr

Resolution

  1. Log onto the back-end server via SSH/Terminal
  2. Run the following to pull the reports that have been deleted
    curl "http://127.0.0.1:8080/solr/cbfeeds/select?=feed_id%3A*+AND+is_deleted%3Atrue&wt=json&indent=true"

Additional Information

  • Reports with is_deleted=true can still show in the UI
  • These reports are not searchable and will not alert