EDR: Triage Alerts Page is Not Populating with Alerts

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Alerts are not populating the Triage Alerts Page in the Web Console

Environment

• EDR Server: All Supported Versions
• Linux: All Supported Versions

Cause

In some cases the cbalerts schema file does not get upgraded correctly

Resolution

1. Stop cb-solr 
    #/usr/share/cb/cbservice cb-solr stop

2.From a working installation of the EDR Server of the same version replace the schema60.xml file in the following locations

    /etc/cb/solr/core_conf/cbalerts/conf/

    and

    /var/cb/data/solr/cbalerts/conf/

3. Restart cb-solr
    #/usr/share/cb/cbservice cb-solr start