CB Response: When performing a process or binary search using the "Bulk IOC" facet, the search fails with the error: "Server errordue to malformed syntax."

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When performing a process or binary search using the "Bulk IOC" facet, the search fails with the error: "Server errordue to malformed syntax."
• Prior to this syntax error, the admin gets a warning "Large number of IOC'sfound. If you experience slow performance, consider building a feed."

Environment

• CB Response Server: 6.0.1 and above
• CB Response Sensors:  All versions.

Cause

There are too many md5 hashes in the IOC list. The limit is roughly around 100. 
 

Resolution

• As the warning states, too many IOC's will degrade performance and is to be avoided.