How often does the VMware Carbon Black EDR sensor check-in with the EDR server?

Issue

We're trying to determine if our Sensor is checking in at regular intervals.  How often should the Carbon Black EDR Sensor be checking in? 

Environment

VMware Carbon Black EDR

Resolution

First, it's important to understand that the Carbon Black Sensor initiates the connection with the server (outbound) and not the other way around. 

The Carbon Black EDR Sensor will checkin in every 30 seconds.  If for some reason the Carbon Black Sensor is unable to checkin with the EDR Server, it will store all events in its queue (up to 2 GB in size) until it is able to successfully checkin with the EDR Server.

NOTE: The Carbon Black User Guide says that "A Sensor checks in with the Carbon Black EDR Server every five minutes to report the activity it detects."  This is incorrect, the default Sensor checkin interval is always 30 seconds.  We never adjust the checkin time unless the Server is having performance issues, but those cases are few and far between. 

Last Checkin Time is defined as "The timespan in which a sensor last checked into the Carbon Black EDR server (last hour, last day, last week, and so on)."

If you would like to know more about how the Sensor Checkin interval is determined, please see the following Carbon Black article: EDR Sensor Checkin Interval For Sensor to Server.