Hosted EDR: URL shows "CB Response Cloud is currently undergoing maintenance and will be back shortly" after using the console to execute a query.
book
Article ID: 289168
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
EDR Console was working, a query was executed and the Console now shows the Maintenance Mode screen
Writing complex or expensive queries or watchlists before the Console became unavailable.
Environment
Hosted EDR: All Versions
Cause
SOLR database is overwhelmed by a specific malformed or expensive query and the Hosted EDR Health Check monitoring service indicates there is problem and the installation automatically goes into Maintenance Mode.
Resolution
Use the built-in Cb Response search query builder utility to write queries in the proper SOLR format, so they are not too expensive or malformed and cause a system outage.
Additional Information
Poorly formed queries that do not use the specific fields (process_name:, etc) will cause the system to search for the requested information against every field, which can cause delays and timeouts.
Leading wildcard queries can have the same effect, causing the system to search fields for information. (Example: *.*)