EDR: How to bulk delete triage alerts

[#1]

Environment

• EDR (formerly CB Response) Server: 6.1 and above (on-prem only)

Objective

Bulk delete alerts from the triage page

Resolution

Deleting alerts will permanently remove them from the system. Consider bulk resolving alerts through the UI or API if alert retention is desired

• Alerts can be removed via curl commands to Solr using the <delete> tags

  • curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>field:value</query></delete>"

Additional Notes

Example queries. Items in bold should be changed with desired field value

• Delete alerts from a specific feed

  • curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>feed_name:feedname</query></delete>"

• Delete alerts from a specific watchlist

  • curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>watchlist_name:watchlist</query></delete>"

• Delete alerts with a specific status

  • curl http://127.0.0.1:8080/solr/cbalerts/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>status:state</query></delete>"