Sensor License Counts and Cleanup

Issue

How long do Sensors take up a license?

How can a user determine current Carbon Black EDR?

Environment

VMware Carbon Black EDR (Response)

Resolution

• License usage is calculated over a 24 hour period. Any sensor offline more than 24 hours will not be counted.
• See https://knowledge.broadcom.com/external/article/289683/edr-is-there-a-way-to-clean-up-sensors-f.html

• The "Current Sensor Count" refers to the total number of sensors that have reported in the last 24 hours. To see this value:
  1. Log into the EDR web interface as an admin user
  2. Click Server Dashboard.
  3. Review the "License Information" panel.

• The "Online Sensor Count" is the total number of sensors reported in the last 5 minutes.
• The "Total Sensor Count" is the sum count of all sensors ever installed - every time a new sensor registers with the cluster, EDR increments this number. If a sensor is uninstalled and later reinstalled, then it counts as 2 for this value. This value has no licensing effect.
• https://community.broadcom.com/symantecenterprise/blogs/cb-support/2024/04/14/edr-how-is-the-sensor-license-count-determined 

Additional Resources

• EDR Server: Automatically Filter Inactive Sensors from the User Interface (7.1.1 and below)
• EDR: Sensors no longer checking in after applying a new license