EDR: How to stop a long running watchlist search job

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Stop a long running watchlist search job

Environment

• EDR Server: All Versions

Resolution

1. Find the PID of the running watchlist_search

   • ps -ef | grep watchlist_search

2. Use the PID from above to kill the process

   • kill -9 <pid_of_watchlist_search>

Additional Information

Inefficient queries should be improved or disabled to prevent future watchlist jobs from running over