Skip to main content
Go to Red Canary Documentation
Red Canary Support

How to Update Sensor Group Names in Red Canary

  • Updated .

Issue

User looking to update the values seen in endpoint_sensor_group reporting tags and the Sensor Group field on endpoint records in Red Canary Portal, or otherwise looking to validate where this name comes from.

Environment

Red Canary Portal
All Supported EDR Integrations

Resolution

Refer to your EDR platform from the list below to determine which organizational feature or function dictates the Sensor Group value in Red Canary, and where to find those features in the third-party platform.  The names configured in each EDR platform for the specified organizational units below are what we use as the Sensor Group name for endpoints in Red Canary Portal.  As a result, the changes must take place in your EDR platform.

Platform

Source of Sensor Group Value

Setting Location

Multi-Group?

Carbon Black Cloud (CBC)

Policy

Enforce > Policies

No

Carbon Black EDR (formerly CB Response)

Sensor Group

Sensors > Groups

No

CrowdStrike

Host Group

Host Setup and Management > Host Groups

Yes

Jamf

N/A

Microsoft Defender for Endpoint

Device Group

System > Settings > Endpoints > Device Groups

No

Palo Alto Cortex XDR

Endpoint Group

Endpoints > Endpoint Groups

Yes

SentinelOne

Group

Account Navigator > [Site Name]

No

Trend Vision One

Endpoint Group

Endpoint Security > Endpoint/Server Protection > Computers

No

For EDR platforms that allow endpoints to reside in multiple organizational groups (as indicated by the Multi-Group? column), the corresponding reporting tag in Red Canary will be formatted as endpoint_sensor_group:"Group A, Group B".  Any relevant filters, queries, or PUP exclusions must match both values, as they appear in Red Canary Portal.  For example, an Endpoints page search for endpoint_sensor_group:"Group A" will return endpoints only in Group A, but not endpoints in both Group A and Group B.

If you are subscribed to Active Remediation services, eligible Windows and macOS endpoints in Sensor Groups using the term  remediate in the group name will be subject to automated Active Remediation playbooks in response to published threats.

Updates to group names or membership in your EDR platform are not reflected immediately in Red Canary Portal.  Endpoint records will need time to fully sync the reporting tag changes.

Cause

In Red Canary, the term "Sensor Group" is used as a generic term in reference to an EDR platform's organizational or policy groups.  As a result, endpoint_sensor_group values are configured solely within the integrated EDR platform.

Tags

asset groups, sensor groups, tagging for autoremediation, sensor group exclusions, how does Red Canary pull sensor group name, where does Red Canary get sensor group tags, how to change sensor group tag, update sensor group name