EDR: How to bulk delete triage alerts by report ID

[#1]

Environment

• EDR Server: all versions

Objective

How to bulk delete triage alerts by report id.

Resolution

• Use below query for deleting triage alert in bulk using report id

curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d '<delete><query>watchlist_id:ReportIDHere</query></delete>'

• For example if report id is 565571 then query will be as below.

curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d '<delete><query>watchlist_id:565571</query></delete>'

 

Additional Notes

More fields are available for deleting triage alerts in this query here: REST API Reference CB R 6.3+ - Carbon Black Developer Network

Related Content

EDR: How to bulk delete triage alerts