EDR: Deleted custom feed report still runs on server

[#1]

Environment

• EDR Server: 7.x
• Custom Feed from file

Symptoms

• Full reports from a feed file have been deleted, but new alerts are still generated
• Debug logging for the full sync show that there is a malformed query

File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/utils/query_string.py", line 46, in raise_if_url_cannot_be_decoded
File "/usr/lib64/python3.8/urllib/parse.py", line 733, in parse_qsl
raise ValueError("bad query field: %r" % (name_value,))
cb.utils.query_string.MalformedEncoding: bad query field:

Cause

A report in the feed has a malformed query 

Resolution

1. Fix the report with the malformed query
2. With root permissions on the server, force a full feed sync: EDR: How to execute an immediate full feed sync

Additional Notes

• Future work will be made to prevent malformed queries from being imported into the server - CB-32839
• Full feed syncs run once a day. If access to the server is not possible, the feed sync should resolve within 24 hours

Related Content

EDR Server: How to enable debug logging for feeds
EDR: How to remove IOCs from custom feed report