Carbon Black EDR (formerly Cb Response)Carbon Black Hosted EDR (formerly Cb Response Cloud)
Issue/Introduction
In the Sensor section of the EDR console, a search for a given computer name results in multiple entries. There should only be one.
Postgres sensor_registration table contains multiple entries for the same endpoint (hostname, mac address, etc) with different sensor IDs.
Environment
EDR Server: 7.8.0
Cause
In some cases, EDR is not processing the incoming events properly, leaving the DNS_name field blank. If VDI is enabled to check hostname + DNS_name, then an event with a blank DNS_name field is seen as a new sensor and registered.
Resolution
Until the sensor data processing is fixed, deselect the DNS_name option in the EDR console VDI settings. ( User > Settings > VDI Settings > DNS Name )
Additional Information
EDR was designed to assign one sensor id per endpoint to uniquely identify that endpoint.
VDI was designed to allow virtual machines to roll back/forward to snapshots and still be identified as the same endpoint.