EDR: How to Pull Watchlist Alerts From Solr
book
Article ID: 289519
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Pull related alerts for a watchlist
Environment
- EDR Server: All Supported Versions
Resolution
- Open an SSH session to the EDR Master server
- Get the affected watchlist's ID. Substitute watchlist_name with the name of the watchlist in the UI
- Pull the alerts for the watchlist. Substitute id with the ID from step 2
Additional Information
- Query will return the first 10 results. To return more results, add '&rows=<number_of_rows>' after '&indent=true'
- Additional settings like creation time can be added to the query in URL encoding format. This will pull all alerts starting at 07/01/2019
curl 'http://127.0.0.1:8080/solr/cbalerts/select?q=watchlist_id%3Aid+AND+created_time%3A\[2019-07-01T00%3A00%3A00.000Z+TO+*\]&wt=json&indent=true'
Feedback
thumb_up
Yes
thumb_down
No