We're trying to determine if our Sensor is checking in at regular intervals. How often should the Carbon Black EDR Sensor be checking in?
VMware Carbon Black EDR
First, it's important to understand that the Carbon Black Sensor initiates the connection with the server (outbound) and not the other way around.
The Carbon Black EDR Sensor will checkin in every 30 seconds. If for some reason the Carbon Black Sensor is unable to checkin with the EDR Server, it will store all events in its queue (up to 2 GB in size) until it is able to successfully checkin with the EDR Server.
NOTE: The Carbon Black User Guide says that "A Sensor checks in with the Carbon Black EDR Server every five minutes to report the activity it detects." This is incorrect, the default Sensor checkin interval is always 30 seconds. We never adjust the checkin time unless the Server is having performance issues, but those cases are few and far between.
Last Checkin Time is defined as "The timespan in which a sensor last checked into the Carbon Black EDR server (last hour, last day, last week, and so on)."
If you would like to know more about how the Sensor Checkin interval is determined, please see the following Carbon Black article: EDR Sensor Checkin Interval For Sensor to Server.
Please sign in to leave a comment.