EDR Server: Automatically Filter Inactive Sensors from the User Interface (7.1.1 and below)
search cancel

EDR Server: Automatically Filter Inactive Sensors from the User Interface (7.1.1 and below)

book

Article ID: 290212

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Enable automated filtering of sensors from the user interface after a set period of inactivity

Environment

  • EDR Server: 5.1.1-7.1.1 version

Resolution

  1. Stop cb-enterprise services
    • ​Single server: service cb-enterprise stop
    • Clustered server: /usr/share/cb/cbcluster stop
  2. Edit /etc/cb/cb.conf and add the following line 
    SensorLookupInactiveFilterDays=30
  3. Start cb-enterprise services
    • Single server: service cb-enterprise start
    • Clustered server: /usr/share/cb/cbcluster start

Additional Information

  • Ensure the SensorLookupInactiveFilterDays value established matches the data retention period configured for the environment
  • When an inactive sensor is filtered, any remaining associated event data for that sensor will no longer be accessible via the user interface
  • Cloud instances have SensorLookupInactiveFilterDays enabled by default with a 60 days value
  • This setting is replaced by "Sensor Display Settings" feature on UI > Sensors page from server version 7.2.0.
Powered by Wolken Software