Sensor Details Heading and Options

The heading in the Sensor Details panel displays the following information and options.

• An icon that represents the operating system of the host computer.

• The name of the host computer.

• Status of the sensor. This can be Online, Offline, Uninstalled, and whether the sensor is restarting, isolated, or syncing. If Carbon Black EDR is not running or if there is a communication problem, the status is Offline.

• A Go Live button starts a Live Response session with the endpoint if Live Response is enabled.

  Note: To use Live Response, you must be a Carbon Black EDR Global Administrator, a Carbon Black Hosted EDR Administrator, or a user on a team that has Analyst privileges.

• Isolates: Isolates a host computer from the rest of the network, leaving only the connections to access the Carbon Black EDR server. If the sensor is isolated, this button displays Remove isolation. The action presents an optional Description text box where you can note the reason for the activity. See Isolating an Endpoint.

• The Actions menu provides the following options:

  • Sync – Forces the sensor to immediately send all the data that it has collected to the Carbon Black EDR server, ignoring any configured bandwidth throttles.

  • Restart – Restarts the sensor process.

  • Move to group – Moves the sensor to another sensor group.

  • Uninstall – Uninstalls the sensor from the host computer.