Hosted EDR: URL shows "CB Response Cloud is currently undergoing maintenance and will be back shortly" after using the console to execute a query.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• EDR Console was working, a query was executed and the Console now shows the Maintenance Mode screen
• Writing complex or expensive queries or watchlists before the Console became unavailable.

Environment

• Hosted EDR: All Versions

Cause

• SOLR database is overwhelmed by a specific malformed or expensive query and the Hosted EDR Health Check monitoring service indicates there is problem and the installation automatically goes into Maintenance Mode.

Resolution

Use the built-in Cb Response search query builder utility to write queries in the proper SOLR format, so they are not too expensive or malformed and cause a system outage.

Additional Information

• Poorly formed queries that do not use the specific fields (process_name:, etc) will cause the system to search for the requested information against every field, which can cause delays and timeouts.
• Leading wildcard queries can have the same effect, causing the system to search fields for information. (Example: *.*)