On any Inventory page in the Carbon Black Cloud console, you can search for specific sensors by any criteria that exists in the list of sensors. For example, you can search for specific devices, users, or operating systems on the Inventory > Endpoints or Inventory > Workloads page.

Search for Sensors Based on Operating System

The following table provides examples of valid operating system search queries. They are not case-sensitive.

Note: Operating system versions listed in the following table are examples only; other operating system versions are accepted.
Table 1. Example Operating System Search Queries
Linux macOS Windows
CentOS 7.9-2009 MAC Windows
RHEL 7.8 OS X Windows Server
Amazon 2.0 10.14.6 Windows 10
Debian 9.13 10.15.7 x64
Ubuntu 19.10 10.14.* where * is a wildcard x86
OpenSUSE Leap 15.2
SLES 12 SP2

Search for Sensors Based on User Name

Create a search query using one of the following search terms:

Search Term Description
loginUserName Currently logged-in user
email User who installed the sensor

Search for Sensors Based on Last Check-in

This search query requires a millisecond epoch timestamp. Various epoch timestamp converters are available online.

Create a search query using an epoch timestamp:

Find Sensors that have checked in since the timestamp
lastContact:>{Epoch_Timestamp}

Find Sensors that have not checked in since the timestamp
lastContact:<{Epoch_Timestamp}

Examples

  • To find sensors that have checked in since 21-Apr-2021 at 12:00:00AM GMT 
    lastContact:>1618963200000
  • To find sensors that have not checked in since 21-Apr-2021 at 12:00:00am GMT 
    lastContact:<1618963200000

Search for Sensors Based on Device Name

This section describes various ways to search for sensors based on device names. Note that special characters in device names act as delimiters and not as part of a string. In this context, special characters are:

- ~ ( ) [ ] { } ^ | & " :

Create a search query using one any of the following search criteria:

  • Searching on a device name works as a plain-text search across all fields. 
    Example search: Win-10-Laptop-0123
Results: Win OR 10 OR Laptop OR 0123 in any field
  • Use specific fields to search on specific information. 
    Example search: name:Win-10-Laptop-0123
Results: Win OR 10 OR Laptop OR 0123 in the Device Name only
  • Use more than one instance of the name: field to search for all parts of the device name. 
    Example search: name:Win name:10 name:Laptop name:0123
Results: Win AND 10 AND Laptop AND 0123 in the Device Name only
  • Use negation (-, AND NOT) to exclude criteria where additional devices are returned. 
    Example search 1: name:Win name:10 -name:Desktop -name:012345 -name:.domain.org
Results: Device Names including Win AND 10 and excluding Desktop AND 012345
  • Use other available fields to narrow results. 
    Example search: name:Win name:10 name:Laptop loginUserName:"Jane Doe"
Results: Device Names including Win AND 10 AND Laptop and where the User field shows Jane Doe

Search for Sensors Based on Domain\Hostname

To search for a domain\hostname, you must escape the \ character. For example:

Domain\\Hostname