CB Response: Can A Watchlist Be Used To Track Last Check-In Time For A Sensor?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Can a watchlist be used to track last check-in time for a sensor?

Environment

• CB Response: 6.2.4 and Higher

Resolution

There is not a way to create a watchlist based on last checkin time of a sensor.

Additional Information

There are two potential workarounds:

Workaround 1:

1. On the sensors pages, select the "All Sensors" under groups.
2. On the right side, select "Filter" and select the "Last Checkin Time".
3. Export to CSV.

Workaround 2:

1. Run the following query on the backend server (master): 

pqsl -p 5002 cb -c "copy (select * from sensor_registrations where last_checkin_time > (CURRENT_DATE - INTERVAL '180 day')) to '/tmp/sensors_180days.csv' with CSV HEADER"