You can check the cluster connection status, which determines whether the cluster is available for global searches in Carbon Black EDR Unified View.

Setting

Description

Disconnect/Connect

Click to specify the cluster’s connection status.

Settings are as follows:

  • Connect (the default) – The cluster is connected and available for all users to include in global process or binary searches.

    When the cluster is connected through the Cluster Management page, individual users can use My Profile to enable or disable the cluster for personal searches without affecting access for other users.

  • Disconnect – The cluster is disconnected and temporarily unavailable for global process or binary searches; however, its configuration information is saved.

    When the cluster is disconnected, users cannot enable or disable it in My Profile.

You can browse a cluster from Carbon Black EDR Unified View whether it is connected or disconnected for searching.

See Scope for Multi-cluster Searches.