Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Checking Sensor Count - In Postgres Database

Checking Sensor Count - In Postgres Database

Environment

  • Cb Response 6.x, 5.x

Objective

  • Find all sensor that have checked in recently.
  • You can use these commands for count and for listing individual sensors

Resolution

  • The below query will find all sensors that have ever checked and are not uninstalled but could be offline.
  • psql -d cb -p 5002 -c "select id, computer_name, uninstalled, last_checkin_time from sensor_registrations where uninstalled IS NULL;"

  • Which can morph in to this which will show you the count of all sensors that have not been uninstalled but could be offline.

  • psql -d cb -p 5002 -c "select count(*) from sensor_registrations where uninstalled IS NULL;"

  • For count of everything that is online in the last 24 hours and is not flagged for uninstall. (This is what your current sensor count would be.)

  • psql -d cb -p 5002 -c "select id, computer_name, uninstalled, last_checkin_time from sensor_registrations where uninstalled IS NULL AND age(last_checkin_time) < INTERVAL '1 day';"

  • psql -d cb -p 5002 -c "select count(*) from sensor_registrations where uninstalled IS NULL AND age(last_checkin_time) < INTERVAL '1 day';"

Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-26-2018
Views:
920