EDR Server: How to remove historic sensors from the WebUI (7.1.1 and below)

[#1]

Environment

• EDR Server Console

Objective

How to remove offline sensors that still appear in the WebUI

Resolution

1. Connect to the Cb Response cluster Master server via SSH

vi /etc/cb/cb.conf

2. Add the following value to the bottom of the file:
   • SensorLookupInactiveFilterDays=30
3. Save the cb.conf file
4. You will need to restart CB for the change to take effect- https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-restart-services/ta-p/41294

Additional Notes

• When 'SensorLookupInactiveFilterDays' is set to 0, it is not active (disabled)
• All disconnected sensors for longer than the value will be removed from view in the WebUI, but their entry in the database table will remain
• Documents and Events related to removed sensors will still exist in the SOLR database

Related Content

• How to remove historic sensors from the UI (v5.1.0 patch 2-patch 3)
• EDR: Events from newer alerts produce 404s