All filtering rules are removed from Data Forwarders during a schema upgrade

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Workload
• Carbon Black Cloud Prevention
• Carbon Black Cloud Managed Detection and Response

Issue/Introduction

When updating the schema version of a Data Forwarder that contains more than 25 filters, the entire list of filters will be completely removed after applying the change. This will force the Data Forwarder to have to be rebuilt from scratch.

Environment

• Carbon Black Cloud Console: Current Version
• Carbon Black Cloud Data Forwarder: All Schema Versions

Cause

Data Forwarder schema enforces a limit of 25 filters per forwarder. If there are more than 25 filters, then the logic is broken and the forwarder is unable to be saved when the schema is updated.

Resolution

The Data Forwarder configuration was updated in July 2025 (CBC-49409) to support the following error handling:

• This 25-filter limit is enforced in the Carbon Black Cloud UI before saving the configuration. Now, once the limit is reached, the "Add Filter" button is disabled, and the "Save" button is also disabled to prevent saving.
• For existing configurations where the filter count exceeds 25, the "Save" button remains disabled and an inline message "Maximum of 25 filters are allowed" is displayed. The save button becomes enabled only when the total number of filters is reduced to 25 or fewer.

Additional Information

https://developer.carbonblack.com/reference/carbon-black-cloud/data-forwarder/api/latest/data-forwarder-api/