Environment
EDR Console: All Versions
Question
Is it possible to remove old endpoint entries from the sensor_registrations table?
Answer
This is not supported, if there is a performance reason for needing this please reach out to support before attempting to delete entries on your own.
Additional Notes
- Removing entries from the postgres table can cause the following:
- Sensor(s) are no longer able to connect if it has the deleted id entry.
- Loading binary metadata in the binary search page can fail with a 404 if the deleted entry is the first sensor id to see that binary execute in the environment
- Loading a process analysis page will fail if the sensor id of the event is no longer available for lookup. The events will still be searchable, but not visible for investigation on the analysis page. This is even more evident for those using cold storage if you load up an older cold core that no longer have an associated id.
