EDR: Watchlist Error: 'HTTPError: 400 Client Error: Bad Request for url'

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Watchlist search failing with following message reported in '/var/log/cb/job-runner/job-runner.log' file:

[watchlist_search] Exception in QueryTracker: HTTPError: 400 Client Error: Bad Request for url: http://<EDR_server_name>:8080/solr/reader/select

 

Environment

• EDR Server: All Versions
• Watchlist query

Cause

• Syntax error in query being sent to Solr
• Watchlist search contains a hidden character
• Normally caused by copy/paste from a text editor 

Resolution

​​​​​​Remove any hidden characters from watchlist query, e.g. white space, carriage returns