The Sensors page in the Carbon Black EDR console provides information about sensors and their host computers (endpoints).
- On the navigation bar, click Sensors.
Groups Panel
The Groups panel on the left side of the Sensors page displays the sensor groups in which the sensors belong:
You can filter the groups that display by group name.
Click the name of the group in the Groups panel to view all sensors in a particular sensor group. The group name appears at the top of the Sensors panel.
Click All Sensors at the top of the Groups panel to view all sensors in all groups.
Sensors panel
Computers (endpoints or hosts) that have installed or uninstalled Carbon Black EDR sensors display in the Sensors panel:
In the top left of the Sensors panel, a count of all sensors per state is displayed:
The following information appears for all sensors on the page:
Field |
Description |
---|---|
Computer Name |
The hostname corresponding to the endpoint on which the sensor is installed. |
Domain Name |
The registered DNS name for the IP address of the endpoint on which the sensor is installed. |
IP Address |
The IP address of the endpoint on which the sensor is installed. |
Status |
Describes the status of sensor connectivity as follows:
If a sensor is being uninstalled, one of the following status descriptions might appear:
|
Activity |
The time that updated data is expected from the sensor; for example, “Was expected 2 seconds ago” or “Last seen about 3 months ago.” |
OS Version |
The operating system version of the endpoint on which the sensor is installed. |
Server Certificate |
The server certificate being used to secure communications with this sensor. |
Node Id |
In a clustered environment, the server ID to which a sensor sends data. For a standalone instance, the value is 0 (zero). |
Sensor Version |
Version of the currently installed Carbon Black EDR sensor. |
Define the List of Displayed Sensors
-
Click the Online, Offline, and/or Uninstall buttons to display matching sensors.
Note: TheSensorLookupInactiveFilterDays
setting determines whether sensors that have not checked in for a specified number of days are filtered out of the Sensors page.This setting has no effect when set to the default value of zero. When set to any value greater than zero, the Sensors page filters out any sensors that have not been checked in during the specified past number of days. This setting filters the results of the API call
GET /api/v1/sensor
.This setting interacts with the setting for
MaxEventStoreDays,
which controls how old warm (mounted) partitions can become before they are unmounted or deleted. IfSensorLookupInactiveFilterDays
is not zero but less than the value ofMaxEventStoreDays
(30 days by default), process data for inactive computers is included in search results. - To search for one or more sensors, see Search for Sensors.
Navigation
When the defined list of sensors cannot fit on a single page, use the controls at the bottom of the page to navigate through multiple pages:
- Enter the number of Items per Page.
- Enter a number to Jump to a Page.
- Click the forward and back arrows to navigate pages sequentially.
- Click a number between the arrows to go to a specific page.