Endpoint Standard: Searching for sensors by IP on investigate page returns multiple machines with same IP
search cancel

Endpoint Standard: Searching for sensors by IP on investigate page returns multiple machines with same IP

book

Article ID: 290952

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Searching for sensors by IP on 'Investigate' page returns multiple machines with same IP.

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Sensor: All versions
  • Microsoft Windows: All Supported Versions

Cause

The 'Investigate' page is the wrong location to search for sensors by IP.  Searching this page by IP will return all events (netcons) where this IP has been recorded not a list of sensors with this IP.  

Resolution

The correct place to search for sensors by IP is under 'Inventory' -> 'Endpoints'