EDR: Check-in Interval for Sensors to Server

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What is the check-in interval for sensors to the EDR server? 

Environment

• EDR Server: 7.5.0 and Higher

Resolution

Defined in /etc/cb/cb.conf. 

• SensorCheckinDelaySec=60

Additional Information

• Default value is 60, setting lower can potentially overwhelm Datagrid, the in memory storage that handles multiple items in the product and communicates with the minions (if clustered)
• Check-in adjustment does not affect event submission time.
• Check-in's provide updated sensor vitals such as the last checkin time, event/binary queue, uptime, sensor health status. This information is not critical to have updated earlier than the default setting. 
• A sensor is considered offline when last checkin time reported is over 5 minutes by default.