EDR: How long will a cluster gather data for after its license expires?
EDR (formerly CB Response): 6.x and Higher
How long will a cluster gather data for after its license expires?
An on-prem EDR cluster with an expired license will continue to collect data from all sensors for an additional 30 days.
After 30 days post-expiration, the cluster will no longer collect data.
Any linux sensors will that check in after the license has been expired for more than 30 days will need to be restarted due to CB-31080
Due to a known issue (CB-17129), data is still transferred over the network after the post-30 days have expired. The cluster rejects that data as expected, but the sensor tries to re-send it over and over, increasing the amount of data. This issue is resolved in Server version 6.2.4.