EDR: How to Delete Alerts Older Than 30 Days in Bulk

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Delete alerts from the Alert Triage page in bulk that are older than 30 days

Environment

• EDR Server On-Prem: All Supported Versions

Resolution

Run the following command directly on the server or via SSH:

curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>created_time:[* TO NOW-30DAYS]</query></delete>"

Additional Information

• To delete alerts using a different time frame, modify * TO NOW-30DAYS to a different DAYS value e.g. * TO NOW-60DAYS which will delete all alerts older than 60 days
• When deleting alerts in bulk based on time in a clustered environment, the above curl command only needs to be executed on the master server