On the Sensors page, you can select sensors by selecting the check boxes next to the sensor names. Use the Actions drop-down list to perform the following actions on one or more selected sensors.
Sync – Forces the sensor to send all the data that it has collected to the Carbon Black EDR server immediately, ignoring any bandwidth throttles that might be configured.
Restart – Restarts the sensor process.
Move to group – Moves the sensor to another sensor group.
Uninstall – Uninstalls the sensor from the host computer.
Isolate – Isolates an endpoint from the rest of the network, leaving only the connections necessary for the Carbon Black EDR server to access its sensor. The action presents an optional description text box where you can note the reason for the activity. The console provides the following cues for an isolated host:
On the Sensors page, the word Isolated appears in the Status column.
-
On the Sensor Details page, the word Isolated appears with the sensor status. A Remove host isolation button is available next to the Actions button.
-
On the Process Analysis page (if a process belonging to the isolated host is being analyzed), the message “This host has been isolated from the rest of the network” appears at the top, and a Remove host isolation button is available beside the Actions button.
Remove isolation – From an isolated state, rejoins an endpoint to the network. The action presents an optional description text box where you can note the reason for the activity.
