EDR Server: How to remove historic sensors from the WebUI (7.1.1 and below)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to remove offline sensors that still appear in the WebUI

Environment

• EDR Server Console

Resolution

1. Connect to the Cb Response cluster Master server via SSH

vi /etc/cb/cb.conf

2. Add the following value to the bottom of the file:
   • SensorLookupInactiveFilterDays=30
3. Save the cb.conf file
4. You will need to restart CB for the change to take effect- https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-restart-services/ta-p/41294

Additional Information

• When 'SensorLookupInactiveFilterDays' is set to 0, it is not active (disabled)
• All disconnected sensors for longer than the value will be removed from view in the WebUI, but their entry in the database table will remain
• Documents and Events related to removed sensors will still exist in the SOLR database