CB Defense: Endpoint shows multiple deregistered instances without corresponding audit logs
book
Article ID: 289709
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
- Console shows multiple sensors for the same endpoint as deregistered
- Sensors may have registered several minutes apart
Environment
- CB PSC Web Console
- CB Defense Sensor: All Versions
- Microsoft Windows: All Supported Versions
Cause
The sensor failed to complete install multiple times. With each install attempt, the failed device was deregistered in the UI
Resolution
If the sensor still has not successfully registered with the server, the underlying install issue will need to be addressed
Additional Information
- Deregistered devices can be removed automatically after a set number of days
- If performing an unattended install, a flag can be added to save the installation to a log for further troubleshooting on failed installations
- If a sensor in the UI does not show details such as the operating system and sensor version, the sensor has not successfully installed
Feedback
thumb_up
Yes
thumb_down
No