Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Workload: Expected Sensor State Matrix

Workload: Expected Sensor State Matrix

Environment

  • Carbon Black Cloud: All Versions
    • Workload
  • vSphere: All Supported Versions

Question

What is the expected state when a VM is on an old sensor, has been Powered Off, is Deleted, cloned, Reverted To a Snapshot,or vMotioned?

Answer

VM has a sensor version prior to 3.6The sensor will appear on the Endpoints tab instead of Workloads tab.
VM is powered offAfter 30 days of inactivity, the sensor is marked as inactive. It will persist on the Enabled tab with Inactive status until removed from the Carbon Black Cloud console.
VM deleted (Sensor not deregistered before deletion)A delete action is triggered from the vCenter Server when a VM gets deleted from the vCenter Server. The workload sensors that are inactive for three or more days and have received a delete action from the vCenter Server gets Deregistered automatically. The deleted VMs are displayed as Deregistered.  Sensor persist on the Enabled tab with the Deregistered status until removed from the Carbon Black Cloud console.
VM deleted (Sensor deregistered before deletion)Sensor will persist on the Enabled tab in the Deregistered status until removed from the Carbon Black Cloud console.
VM reverted to a snapshot prior to sensor installationAfter 30 days, the sensor is marked as inactive. The VM is available for sensor installation on the Not Enabled tab. If the installation is triggered on the VM again, there will be two entries for the same VM on the Enabled tab after new installation.
VM reverted to a snapshot when an older sensor was installedIf the sensor version is below 3.6, it will move to the Endpoints tab of the Carbon Black Cloud console. If the sensor is still  on 3.6+ after reverting, it will continue to display on the Workloads tab.
VM reverted to a snapshot with a different registration IDThe sensor appears on the Workloads > Enabled tab as a new entry. If the previous entry had not been removed, there will be two entries for the same VM.
VM with a sensor is clonedRefer to the Cloning Guide
VM is vMotioned to another vCenter Server which is not connected to the applianceSensor stays in the Registered -> Active state on the Enabled tab. The details panel may not show any additional data.

Related Content


Labels (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-02-2021
Views:
648
Contributors