Environment
Symptoms
- In the Sensor section of the EDR console, a search for a given computer name results in multiple entries. There should only be one.
- Postgres sensor_registration table contains multiple entries for the same endpoint (hostname, mac address, etc) with different sensor IDs.
Cause
In some cases, EDR is not processing the incoming events properly, leaving the DNS_name field blank. If VDI is enabled to check hostname + DNS_name, then an event with a blank DNS_name field is seen as a new sensor and registered.
Resolution
Until the sensor data processing is fixed, deselect the DNS_name option in the EDR console VDI settings. ( User > Settings > VDI Settings > DNS Name )
Additional Notes
- EDR was designed to assign one sensor id per endpoint to uniquely identify that endpoint.
- VDI was designed to allow virtual machines to roll back/forward to snapshots and still be identified as the same endpoint.
Related Content
