EDR: Same Endpoint Showing Twice in Console, One With Online and One With Offline Status

[#1]

Environment

• CB EDR Server: 5.x and higher
• CB EDR Sensor: All Versions

Symptoms

• Same endpoint(s) showing multiple entries in the EDR console, one with status of Online, one (or more) with status of Offline.
• IP and MAC address of endpoint(s) are same in both Online and Offline entries.

Cause

Sensor has been uninstalled and reinstalled on endpoint, causing new Sensor ID to be created for same endpoint.

Resolution

Offline sensors can be filtered out in the Sensor Display options on the console: Getting Started using the Sensor Page

Additional Notes

• Removing duplicate sensors via the console cannot be completed at this time.
• Sensors that are upgraded get re-installed and can see the same results

Related Content

Getting Started using the Sensor Page
EDR Server: Automatically Filter Inactive Sensors from the User Interface (7.1.1 and below)