Carbon Black Cloud: Why Does A Sensor Change Groups After Custom Sensor Groups are Configured?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why do Sensors change Policy after Sensor Groups have been configured and Sensors have been assigned automatically?

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: 3.1.x.x and Higher (Windows); 3.2.x.x and Higher (MacOS)
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

• The Sensor checks for network changes every 60 seconds
• If a change is detected, the Sensor will check the status of the local machine to determine if the Sensor Group criteria are still met
• The Sensor Group and related Policy will be maintained or updated accordingly

Additional Information

• The Sensor Group criteria allow for dynamic group membership and Policy assignment
• If Sensors no longer meet any Sensor Group criteria, they will be assigned to the Standard Policy
• In 3.5.x versions, if the sensor is not able to obtain AD info, the AD info is cleared and reported as none