EDR: Same endpoint name has multiple entries with different registration dates

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• One endpoint name has multiple sensor entries in EDR console
• Every entry is checking in
• Registration dates are different
• IP address, MAC address and Sensor ID are different

Environment

• EDR: All supported versions

Cause

Devices with the same name have sensor registered in the same EDR server.

Resolution

1. Update hostname from local device to differentiate each of them
2. Reinstall sensors on devices if needed

Additional Information

• This KB is for different physical hosts with the same name.
• If the hosts are VDIs/VMs from same master image, then follow this KB to troubleshoot:
  • https://community.carbonblack.com/t5/Knowledge-Base/EDR-Duplicate-sensors-due-to-misconfigured-VDI/ta-p/69850