How to Deregister a Sensor from Pulse
Deregistering a sensor from Pulse is a simple process. The first step is performed from the sensor itself. The second step is performed from within Pulse, and is optional depending upon whether the data discovered by the sensor in the initial network subnet is to be retained within Pulse.
- Establish either an SSH connection (or a reverse SSH connection) to the sensor and login with the "pwnie" user account.
- Type sudo su and press Enter, then re-enter the required password to become superuser.
- Type px-deregister-dispatch and press Enter.
- When prompted, select "Yes" to continue.
- After returned to a "#" prompt, type reboot and press Enter to reboot the sensor. After the sensor has been rebooted, it is ready to be moved to the new network subnet intended.
In most use cases, it will be desired to remove all of the learned data from Pulse, allowing the process to start over when the sensor is deployed to a new, different network. To accomplish this, proceed to Step Two outlined below.
In some use cases, it may be desired to retain all of the learned data within Pulse. However, when the sensor is configured and deployed to a new, different network, it is required to specify the sensor name (when registering it to Pulse) differently from what the sensor name was when it was deployed in the initial network. In this use-case, all assets and data discovered in the new, different network will be reflected within the same Pulse environment, but attributed to the latest sensor name specified.
- Login to Pulse and go to the "Sensors" page.
- Select the sensor to be removed from Pulse.
- Select "Settings" at the top of the pop-up window, then click the "Deregister" button in the upper-right corner.
- Enter your password to remove the sensor from Pulse.
- At this time, all assets and data discovered will begin to be removed from Pulse. Depending on the volume of data, this process may take several minutes.