EDR: How Long Before a Sensor Shows as Offline?
Article ID: 286272
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How long must a sensor not check in for before the EDR web interface marks it as 'Offline'?
Environment
- EDR Server: 7.x and Higher
- EDR Sensor: All Supported Versions
Resolution
5 minutes.
Additional Information
- A sensor will send event telemetry more often than 5 minutes.
- Full check-ins occur every 5 minutes.
- This value can be adjusted in the /var/cb/cb.conf file by adding or adjusting the SensorCheckinOnlineIntervalMin value. The default value is 5 minutes:
SensorCheckinOnlineIntervalMin = 5
- To set it to 6 minutes (for example), set:
SensorCheckinOnlineIntervalMin = 6
- It can be problematic if this setting is set too high or too low, please be careful when using the above config option
Feedback
Yes
No
Powered by
