PSC: How To Determine What Policy Was Assigned When Sensor Deregistered

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

 How to determine what policy was assigned when sensor deregistered

Environment

• PSC Console: All Versions
• PSC Sensor: All Supported Versions
  • CB Defense
  • CB ThreatHunter

Resolution

1. Log in to the PSC Console
2. Navigate to the "Endpoints" Page
3. Select "Deregistered" from the "Status" filter
4. The "Policy" column will display the last policy assigned when sensor deregistered

Additional Information

• Select "Export" to save results as .csv file, if needed; For example, to filter in Excel or to cross-reference with a list from another source
• The Devices API can be used as an alternative to exporting a .csv file from the "Endpoints" page