Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Will uninstalled sensor records stay in the UI forever?

EDR: Will uninstalled sensor records stay in the UI forever?

Environment

  • EDR Server: 7.1.1 and lower

Question

Will uninstalled sensor records remain in the EDR Web UI forever?

Answer

  • By default, uninstalled sensor records remain in the EDR Web UI "forever."
  • Those records can be filtered out using the "Show Uninstalled Sensors" checkbox located on the main sensor list page.
  • /etc/cb/cb.conf option to remove inactive/uninstalled sensors after "X" days of not receiving data:
SensorLookupInactiveFilterDays=X

Additional Notes

  • The "SensorLookupInactiveFilterDays" setting is replaced by "Sensor Display Settings" feature on UI > Sensors page from server version 7.2.0 onwards.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-02-2019
Views:
1932
Contributors