EDR: How to Delete Alerts Older Than 30 Days in Bulk
book
Article ID: 289862
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Delete alerts from the Alert Triage page in bulk that are older than 30 days
Environment
EDR Server On-Prem: All Supported Versions
Resolution
Run the following command directly on the server or via SSH:
curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>created_time:[* TO NOW-30DAYS]</query></delete>"
Additional Information
To delete alerts using a different time frame, modify * TO NOW-30DAYS to a different DAYS value e.g. * TO NOW-60DAYS which will delete all alerts older than 60 days
When deleting alerts in bulk based on time in a clustered environment, the above curl command only needs to be executed on the master server