CB PSC: How To Identify Potentially Inoperative Sensors From The Endpoint Console CSV Export

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How to identify potentially inoperative sensors from the endpoint console CSV export

Environment

• CB PSC Console: Currently Supported Versions
• CB PSC Sensors: Currently Supported Versions

Resolution

1. Within the PSC Console, go to the Endpoints page
2. Select the CSV Export button and save the .csv export locally 
3. Open the file with Excel and save as an .xlsx
4. Filter on the "lastContactTime" column - limit the time frame by selecting items within the last month or two weeks 
5. Filter on the "sensorVersion" column - select items with "blanks" 
6. Copy the "name" column into a new excel tab 
7. From the new tab, sort the "name" column from A-Z 
8. Select the "name" column and Remove Duplicates (from the Data menu in excel) 
9. The output will be a list of system names that do not have a sensor version being reported and have communicated with the back end within your specified time frame. 

Additional Information

https://support.office.com/en-us/article/filter-data-in-a-range-or-table-01832226-31b5-4568-8806-38c37dcc180e

https://support.office.com/en-us/article/find-and-remove-duplicates-00e35bea-b46a-4d5d-b28e-66a552dc138d