EDR: What Functionality Remains After the License Expires?

[#1]

Environment

EDR Servers: All versions (on premise only)

Question

What functionality remains after the EDR license expires?

Answer

After the license expires for on-prem EDR servers:

The following features remain working:

• The console is still accessible
• Events are still searchable
• Sensors still communicate (check-in) with the EDR server.

The following features no longer work after the 30-day grace period:

• Sensors do not submit the data. They queue the data based on group configurations.
• Threat intel no longer updates.
• All other functions like live response, banning (new hashes) will no longer work.
• Updates and new software packages are not available.

Additional Notes

• Hosted EDR instances shut down after a 30 day grace period.

Related Content

• EDR: How to Update the Server license
• ttps://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-apply-the-license-via-the-back-end/ta-p/69933
• EDR: How Long Will an EDR Server Gather Data for After its License Expires?
• CB Response: Out of License Message from Sensors