Cb Response: Error "Too Many Reports" when trying to bulk ignore threat reports

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

 Error "Too Many Reports" when trying to bulk ignore threat reports

Environment

• Cb Response Console: 6.x

Cause

MaxRowsSolrReportQuery is set to 10000 by default and and the number of reports trying to be cleared exceeds that

Resolution

Add or update MaxRowsSolrReportQuery in the /etc/cb/cb.conf to the desired number of threat reports to be ignored and restart the cb services.