EDR: How Long Will an EDR Server Gather Data for After its License Expires?

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

How long will a server gather data for after its license expires?

Environment

• EDR (formerly CB Response): 6.x and Higher

Resolution

• An EDR server with an expired license will continue to collect data from all sensors for an additional 30 days.
• After 30 days post-expiration, the server will no longer collect data. 

Additional Information

• Any linux sensors will that check in after the license has been expired for more than 30 days will need to be restarted due to CB-31080
• Due to a known issue (CB-17129), data is still transferred over the network after the post-30 days have expired. The cluster rejects that data as expected, but the sensor tries to re-send it over and over, increasing the amount of data. This issue is resolved in Server version 6.2.4.