The Sensors page in the Carbon Black EDR console provides information about sensors and their host computers (endpoints).

  • On the navigation bar, click Sensors.

Groups Panel

The Groups panel on the left side of the Sensors page displays the sensor groups in which the sensors belong:

The groups panel

You can filter the groups that display by group name.

Click the name of the group in the Groups panel to view all sensors in a particular sensor group. The group name appears at the top of the Sensors panel.

Click All Sensors at the top of the Groups panel to view all sensors in all groups.

Sensors panel

Computers (endpoints or hosts) that have installed or uninstalled Carbon Black EDR sensors display in the Sensors panel:

The sensors page

In the top left of the Sensors panel, a count of all sensors per state is displayed:

The Sensors panel

The following information appears for all sensors on the page:

Field

Description

Computer Name

The hostname corresponding to the endpoint on which the sensor is installed.

Domain Name

The registered DNS name for the IP address of the endpoint on which the sensor is installed.

IP Address

The IP address of the endpoint on which the sensor is installed.

Status

Describes the status of sensor connectivity as follows:

  • Online – Sensor communicated with the server within the previous expected check-in interval.

  • Offline – Sensor did not communicate with the server for more than a five-minute period after the expected check-in interval provided during the previous check-in.

    If known, offline status might include one of the following reasons:

    • Offline (Suspended) – Sensor detected that an OS-level suspend operation occurred before the sensor went offline.

    • Offline (Restarting) – Sensor detected that an OS-level restart operation occurred before the sensor went offline.

    • Offline (Isolate configured) – Sensor is offline and marked for isolation upon next check-in.

    • Offline Uninstalled – Appears when an uninstall was requested for an offline sensor.

If a sensor is being uninstalled, one of the following status descriptions might appear:

  • Uninstall uninstalled – Requested uninstall operation has completed, and the sensor was successfully uninstalled.

  • Uninstall pending uninstalled – Uninstall operation was requested but has not yet completed.

Activity

The time that updated data is expected from the sensor; for example, “Was expected 2 seconds ago” or “Last seen about 3 months ago.”

OS Version

The operating system version of the endpoint on which the sensor is installed.

Server Certificate

The server certificate being used to secure communications with this sensor.

Node Id

In a clustered environment, the server ID to which a sensor sends data.

For a standalone instance, the value is 0 (zero).

Sensor Version

Version of the currently installed Carbon Black EDR sensor.

Define the List of Displayed Sensors

  • Click the Online, Offline, and/or Uninstall buttons to display matching sensors.

    Note: The SensorLookupInactiveFilterDays setting determines whether sensors that have not checked in for a specified number of days are filtered out of the Sensors page.

    This setting has no effect when set to the default value of zero. When set to any value greater than zero, the Sensors page filters out any sensors that have not been checked in during the specified past number of days. This setting filters the results of the API call GET /api/v1/sensor .

    This setting interacts with the setting for MaxEventStoreDays, which controls how old warm (mounted) partitions can become before they are unmounted or deleted. If SensorLookupInactiveFilterDays is not zero but less than the value of MaxEventStoreDays (30 days by default), process data for inactive computers is included in search results.

  • To search for one or more sensors, see Search for Sensors.

Navigation

When the defined list of sensors cannot fit on a single page, use the controls at the bottom of the page to navigate through multiple pages:

  • Enter the number of Items per Page.
  • Enter a number to Jump to a Page.
  • Click the forward and back arrows to navigate pages sequentially.
  • Click a number between the arrows to go to a specific page.