EDR: How to remove IOCs from custom feed report

[#1]

Environment

• EDR server: All versions

Objective

Remove IOCs from a custom feed report

Resolution

• To remove some IOCs from a report

1. Remove IOCs from the report
2. Update the timestamp of the report
3. Optional: Force a feed sync - EDR: How to execute an immediate full feed sync

• To remove an entire report

1. Remove all IOCs from the report
2. Update the timestamp rather than removing the report
3. Optional: Force a feed sync - EDR: How to execute an immediate full feed sync

Related Content

carbonblack/cbfeeds