Endpoint Standard: Searching for sensors by IP on investigate page returns multiple machines with same IP
book
Article ID: 290952
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Searching for sensors by IP on 'Investigate' page returns multiple machines with same IP.
Environment
Carbon Black Cloud Console: All Versions
Carbon Black Cloud Sensor: All versions
Microsoft Windows: All Supported Versions
Cause
The 'Investigate' page is the wrong location to search for sensors by IP. Searching this page by IP will return all events (netcons) where this IP has been recorded not a list of sensors with this IP.
Resolution
The correct place to search for sensors by IP is under 'Inventory' -> 'Endpoints'