EDR Server: Automatically Filter Inactive Sensors from the User Interface (7.1.1 and below)
book
Article ID: 290212
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Enable automated filtering of sensors from the user interface after a set period of inactivity
Environment
- EDR Server: 5.1.1-7.1.1 version
Resolution
- Stop cb-enterprise services
- ​Single server: service cb-enterprise stop
- Clustered server: /usr/share/cb/cbcluster stop
- Edit /etc/cb/cb.conf and add the following line
SensorLookupInactiveFilterDays=30
- Start cb-enterprise services
- Single server: service cb-enterprise start
- Clustered server: /usr/share/cb/cbcluster start
Additional Information
- Ensure the SensorLookupInactiveFilterDays value established matches the data retention period configured for the environment
- When an inactive sensor is filtered, any remaining associated event data for that sensor will no longer be accessible via the user interface
- Cloud instances have SensorLookupInactiveFilterDays enabled by default with a 60 days value
- This setting is replaced by "Sensor Display Settings" feature on UI > Sensors page from server version 7.2.0.
Feedback
thumb_up
Yes
thumb_down
No