EDR: How to remove IOCs from custom feed report

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Remove IOCs from a custom feed report

Environment

• EDR server: All versions

Resolution

• To remove some IOCs from a report

1. Remove IOCs from the report
2. Update the timestamp of the report
3. Optional: Force a feed sync - https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-execute-an-immediate-full-feed-sync/ta-p/34282

• To remove an entire report

1. Remove all IOCs from the report
2. Update the timestamp rather than removing the report
3. Optional: Force a feed sync - https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-execute-an-immediate-full-feed-sync/ta-p/34282