Feed report timestamps not updating with sync

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Multiple feeds show old timestamps

• Feed report in Threat Intelligence > Threat Reports shows an old date. 

Environment

• Carbon Black EDR: All Versions

Cause

Several feeds have been decommissioned and but still appear in the UI or expected to not be updated. 

Resolution

• These feeds are currently not updating due to changes with the third party APIs. At this time there is not ETA on when these feeds would be fixed
  • fbthreatexchange
  • alienvault
• This feed has been decommissioned and will be removed from the UI in the future.
  • NVD
• This feed contains example reports from CbInspection. CbInspection was a paid service that is no longer offered. 
  • CbInspection 
• This feed behaves differently from other feeds. It is updated when there is a hash seen in the environment with a score that is potentially malicious. The feed will then be updated to include that new hash report. Otherwise, the feedsync will not update it.
  • SRSThreat
  • SRSTrust
• This feed is a static feed for tamper protection. No updates are expected. 
  • TamperDetection

Additional Information

• When viewing the report timestamps showing months since last update:
  • The dates are the last time that single report was updated.
  • This does not mean the feed itself is not being updated.
  • The timestamp would only change if the report was updated/changed and the feed provider updated the epoch timestamp fields in the JSON file. 
• Feeds are not expected to get daily, weekly or even monthly new reports. This depends on the feeds and what has been discovered and shared. 
• By default the reports are sorted by "Severity". Sort by "Most Recently Updated" for the latest feed reports.