Environment
- EDR Server: 7.1.1 and lower
Question
Will uninstalled sensor records remain in the EDR Web UI forever?
Answer
- By default, uninstalled sensor records remain in the EDR Web UI "forever."
- Those records can be filtered out using the "Show Uninstalled Sensors" checkbox located on the main sensor list page.
- /etc/cb/cb.conf option to remove inactive/uninstalled sensors after "X" days of not receiving data:
SensorLookupInactiveFilterDays=X
Additional Notes
- The "SensorLookupInactiveFilterDays" setting is replaced by "Sensor Display Settings" feature on UI > Sensors page from server version 7.2.0 onwards.
Related Content
