EDR: Will uninstalled sensor records stay in the UI forever?
search cancel

EDR: Will uninstalled sensor records stay in the UI forever?

book

Article ID: 286274

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Will uninstalled sensor records remain in the EDR Web UI forever?

Environment

  • EDR Server: 7.1.1 and lower

Resolution

  • By default, uninstalled sensor records remain in the EDR Web UI "forever."
  • Those records can be filtered out using the "Show Uninstalled Sensors" checkbox located on the main sensor list page. 
  • /etc/cb/cb.conf option to remove inactive/uninstalled sensors after "X" days of not receiving data: 
SensorLookupInactiveFilterDays=X
​​​​​​

Additional Information

  • The "SensorLookupInactiveFilterDays" setting is replaced by "Sensor Display Settings" feature on UI > Sensors page from server version 7.2.0 onwards.