EDR Server: Automatically Filter Inactive Sensors from the User Interface (7.1.1 and below)

[#1]

Environment

• EDR Server: 5.1.1-7.1.1 version

Objective

Enable automated filtering of sensors from the user interface after a set period of inactivity

Resolution

1. Stop cb-enterprise services
   • Single server: service cb-enterprise stop
   • Clustered server: /usr/share/cb/cbcluster stop
2. Edit /etc/cb/cb.conf and add the following line

   SensorLookupInactiveFilterDays=30

3. Start cb-enterprise services
   • Single server: service cb-enterprise start
   • Clustered server: /usr/share/cb/cbcluster start

Additional Notes

• Ensure the SensorLookupInactiveFilterDays value established matches the data retention period configured for the environment
• When an inactive sensor is filtered, any remaining associated event data for that sensor will no longer be accessible via the user interface
• Cloud instances have SensorLookupInactiveFilterDays enabled by default with a 60 days value
• This setting is replaced by "Sensor Display Settings" feature on UI > Sensors page from server version 7.2.0.

Related Content

How to remove historic sensors from the UI (v5.1.0 patch 2-patch 3)
Carbon Black Enterprise Response v5.1.1 - Release Notes
https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-Cloud-How-long-are-inactive-sensors-...