EDR Server: How to remove historic sensors from the WebUI (v5.1.1+)

[#1]

Environment

• EDR Server Console

Objective

How to remove offline sensors that still appear in the WebUI

Resolution

1. Connect to the Cb Response cluster Master server via SSH

vi /etc/cb/cb.conf

2. Add the following value to the bottom of the file:
   • SensorLookupInactiveFilterDays=30
3. Save the cb.conf file
4. You will need to restart CB for the change to take effect- https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-restart-services/ta-p/41294

Additional Notes

• When 'SensorLookupInactiveFilterDays' is set to 0, it is not active (disabled)
• All disconnected sensors for longer than the value will be removed from view in the WebUI, but their entry in the database table will remain
• Documents and Events related to removed sensors will still exist in the SOLR database

Related Content

• https://community.carbonblack.com/docs/DOC-3146 
• https://community.carbonblack.com/docs/DOC-17373