EDR: How to tag/untag feed binaries and events

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Untag events and binaries associated with a feed
• Tag events and binaries associated with a feed

Environment

• EDR Server: All Versions

Resolution

1. Use the cbfeed scrubber to remove exiting tags for the feed: 

   • /usr/share/cb/cbfeed_scrubber --untag <feedname>

2. Run the following to retag the binaries:
   • 6.2.1 and below

     • /usr/bin/python -m cb.maintenance.job_runner --master -vvv feed_search --tag --feed <feedname> --iocs md5​​​

   • 6.2.2 and above

     • /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -vvv feed_search --tag --feed <feedname> --iocs md5

Additional Information

These steps are usually used in situations where a feed is incorrectly sending alerts for disabled feeds / tagged events.