How to Deregister a Sensor from Pulse
Deregistering a sensor from Pulse is a simple process. The first step is performed from the sensor itself. The second step, which is optional depending upon whether the data discovered by the sensor is to be retained within Pulse, is performed from within Pulse.
- Establish either an SSH connection (or a reverse SSH connection) to the sensor and login with the "pwnie" user account.
- Type sudo su and press Enter, then re-type the password to become superuser.
- Next, type px-deregister-dispatch and press Enter.
- When prompted, select "Yes" to continue. With the exception of its network configuration, various configuration-related files and logs will be removed from the sensor. As a result, it may take several minutes to complete.
- When returned to the "#" prompt, type reboot and press Enter to reboot the sensor.
- After the sensor has been rebooted, it is ready to be moved to the new network subnet intended.
At this time, all of the wired and wireless assets discovered by the sensor in the initial network as well as all threats, alerts, etc. will be retained within Pulse, reflecting their last state of discovery and information learned.
In most use cases, it will be desired to remove all of the learned data from Pulse, allowing the process to start over when the sensor is deployed to a new, different network. To accomplish this, proceed to Step Two outlined below.
In some use cases, it may be desired to retain all of the learned data within Pulse. However, when the sensor is configured and deployed to a new, different network, it is required to specify the sensor name (when registering it to Pulse) differently from what the sensor name was when it was deployed in the initial network. In this use-case, all assets and data discovered in the new, different network will be reflected within the same Pulse environment, but attributed to the latest sensor name specified.
- Login to Pulse and go to the "Sensors" page.
- Select the sensor to be removed from Pulse.
- Select "Settings" at the top of the pop-up window, then click the "Deregister" button in the upper-right corner.
- Enter your password to remove the sensor from Pulse.
- At this time, all assets and data discovered will begin to be removed from Pulse. Depending on the volume of data, this process may take several minutes.