Endpoint Standard: Wrong sensor group detected if AD Criteria has FQDN
search cancel

Endpoint Standard: Wrong sensor group detected if AD Criteria has FQDN

book

Article ID: 290736

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

  • Sensor is set to be automatically assigned to a sensor group and the associated policy
  • AD criteria includes FQDN including terms like ".com or .in or .local" or any similar extension
  • Irrespective of the remaining criteria, the search matches the extension and assigns the sensor to the first sensor group available

Environment

  • Carbon Black Cloud (Formerly PSC) Console: All Versions
  • Endpoint StandardĀ (Formerly CB Defense) Sensor: All Versions
  • Microsoft Windows: All Supported Versions

Cause

When matching sensor groups by AD Domain that containsĀ ".com or .in or .local" or any similar extension, it treats each term of the name as a separate matching test

Resolution

  • Ensure that the AD Criteria does not include terms likeĀ ".com or .in or .local" or any similar extension that may be common between multiple Sensor group Criteria
  • Example: Change AD criteria from Contains "abc.com" to Contains "abc"