How to move Sensors in bulk to specific Sensor Groups in Carbon Black Enterprise Response

[#1]

Version

This solution applies to any version of Carbon Black Enterprise Response.

Topic

This document answers a commonly asked question regarding how to move Sensors by computer name or Sensor ID into a specific group without UI interaction.

Steps

You will need root access

1) Log into Postgres database on server

psql -d cb -p 5002

2) Check the group id's

select id,name from sensor_groups;

3) Display the sensors and current groups assigned

select id,group_id,computer_name from sensor_registrations;

4) Update the sensors with the new group based upon partial computer name

update sensor_registrations set group_id=<newgroup_id> where computer_name like '%<partial computername>%';

Example

update sensor_registrations set group_id=3 where computer_name like '%HostsPrefix-%';

One can also use sensor id range:

update sensor_registrations set group_id=<newgroup_id> where id between # and #;

update sensor_registrations set group_id=3 where id between 1 and 20;

5) Confirm sensors have changed by running step 3 and selecting the sensor group in the