Sensor License Counts and Cleanup

Issue

How long do Sensors take up a license?

How can a user determine current Carbon Black EDR?

Environment

VMware Carbon Black EDR (Response)

Resolution

• License usage is calculated over a 24 hour period. Any sensor offline more than 24 hours will not be counted.
• See https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-Is-there-a-way-to-clean-up-sensors-for-license-usage/ta-p/81623

• The "Current Sensor Count" refers to the total number of sensors that have reported in the last 24 hours. To see this value:
  1. Log into the EDR web interface as an admin user
  2. Click Server Dashboard.
  3. Review the "License Information" panel.

• The "Online Sensor Count" is the total number of sensors reported in the last 5 minutes.
• The "Total Sensor Count" is the sum count of all sensors ever installed - every time a new sensor registers with the cluster, EDR increments this number. If a sensor is uninstalled and later reinstalled, then it counts as 2 for this value. This value has no licensing effect.
• https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-is-the-sensor-license-count-determined/ta-p/63240

Additional Resources

• https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-Automatically-Filter-Inactive-Sensors-from-the-User/ta-p/42833
• https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-Sensors-no-longer-checking-in-after-applying-a-new/ta-p/81973