On any Inventory page in the Carbon Black Cloud console, you can search for specific sensors by any criteria that exists in the list of sensors. For example, you can search for specific devices, users, or operating systems on the or page.
Search for Sensors Based on Operating System
The following table provides examples of valid operating system search queries. They are not case-sensitive.
Linux | macOS | Windows |
---|---|---|
CentOS 7.9-2009 | MAC | Windows |
RHEL 7.8 | OS X | Windows Server |
Amazon 2.0 | 10.14.6 | Windows 10 |
Debian 9.13 | 10.15.7 | x64 |
Ubuntu 19.10 | 10.14.* where * is a wildcard | x86 |
OpenSUSE Leap 15.2 | ||
SLES 12 SP2 |
Search for Sensors Based on User Name
Create a search query using one of the following search terms:
Search Term | Description |
---|---|
loginUserName |
Currently logged-in user |
email |
User who installed the sensor |
Search for Sensors Based on Last Check-in
This search query requires a millisecond epoch timestamp. Various epoch timestamp converters are available online.
Create a search query using an epoch timestamp:
Find Sensors that have checked in since the timestamp lastContact:>{Epoch_Timestamp} Find Sensors that have not checked in since the timestamp lastContact:<{Epoch_Timestamp}
Examples
- To find sensors that have checked in since 21-Apr-2021 at 12:00:00AM GMT
lastContact:>1618963200000
- To find sensors that have not checked in since 21-Apr-2021 at 12:00:00am GMT
lastContact:<1618963200000
Search for Sensors Based on Device Name
This section describes various ways to search for sensors based on device names. Note that special characters in device names act as delimiters and not as part of a string. In this context, special characters are:
- ~ ( ) [ ] { } ^ | & " :
Create a search query using one any of the following search criteria:
- Searching on a device name works as a plain-text search across all fields.
Example search: Win-10-Laptop-0123 Results: Win AND 10 AND Laptop AND 0123 in any field
- Use specific fields to search on specific information.
Example search: name:Win-10-Laptop-0123 Results: Win AND 10 AND Laptop AND 0123 in the Device Name only
- Use more than one instance of the
name:
field to search for all parts of the device name.Example search: name:Win name:10 name:Laptop name:0123 Results: Win AND 10 AND Laptop AND 0123 in the Device Name only
- Use negation (
-
,AND NOT
) to exclude criteria where additional devices are returned.Example search 1: name:Win name:10 -name:Desktop -name:012345 -name:.domain.org Results: Device Names including Win AND 10 and excluding Desktop AND 012345
- Use other available fields to narrow results.
Example search: name:Win name:10 name:Laptop loginUserName:"Jane Doe" Results: Device Names including Win AND 10 AND Laptop and where the User field shows Jane Doe
Search for Sensors Based on Domain\Hostname
To search for a domain\hostname, you must escape the \
character. For example:
Domain\\Hostname