EDR: How to stop a long running watchlist search job

[#1]

Environment

• EDR Server: All Versions

Objective

Stop a long running watchlist search job

Resolution

1. Find the PID of the running watchlist_search

   • ps -ef | grep watchlist_search

2. Use the PID from above to kill the process

   • kill -9 <pid_of_watchlist_search>

Additional Notes

Inefficient queries should be improved or disabled to prevent future watchlist jobs from running over