EDR: Will uninstalled sensor records stay in the UI forever?
book
Article ID: 286274
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Will uninstalled sensor records remain in the EDR Web UI forever?
Environment
- EDR Server: 7.1.1 and lower
Resolution
- By default, uninstalled sensor records remain in the EDR Web UI "forever."
- Those records can be filtered out using the "Show Uninstalled Sensors" checkbox located on the main sensor list page.
- /etc/cb/cb.conf option to remove inactive/uninstalled sensors after "X" days of not receiving data:
SensorLookupInactiveFilterDays=X
Additional Information
- The "SensorLookupInactiveFilterDays" setting is replaced by "Sensor Display Settings" feature on UI > Sensors page from server version 7.2.0 onwards.
Feedback
thumb_up
Yes
thumb_down
No