Carbon Black Cloud: Incorrect Auto-Deregistration of VDI due to last Check-In delay

Products

• Carbon Black Cloud Workload
• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

VDI endpoints are auto-deregistered despite recent events being searchable in the Investigate page.

Environment

• Carbon Black Cloud Console: All Versions
  • Audit & Remediation (Formerly CB LiveOps)
  • Endpoint Standard (Formerly CB Defense)
  • Enterprise EDR (Formerly CB ThreatHunter)
• Carbon Black Cloud Windows Sensor: All Versions
• US Backend (Prod05)

Cause

A data pipeline bottleneck is preventing the Last Check-In time from being properly updated.

Resolution

Increase the Auto Deregistration time to Greater than 1 Hour.

Additional Information

Future enhancements to the US Backend will resolve the bottleneck.