Hi everyone, I'm new to managing Cybereason and mostly work with data pipelines. We've hit a problem I'm hoping you can help with.
Our critical servers are air-gapped from the internet. The Cybereason sensor on them keeps disconnecting from the management console every few days. We have to manually restart the sensor service to get it back. Our network team says the internal network path is stable. Has anyone else dealt with this in an isolated environment? Are there specific logs or timeout settings we should check first?
Ah, air-gapped setups always add a fun twist! Been there with other agents.
The first thing I'd check is the sensor's heartbeat/keepalive timeout against your internal network's connection tracking. Even on a stable path, a stateful firewall or load balancer might be dropping idle sessions. The sensor might not be re-establishing gracefully.
Logs: look for `sensor.log` (usually in `/var/log/` or `C:ProgramDataCybereasonLogs`). Search for "connection" or "timeout" errors just before the disconnects. There might be a config file for the comms timeout values you can adjust.
Also, does your internal DNS fully resolve the management console hostname from the isolated network? Weird intermittent DNS failures could look like a network issue.
Webhooks or bust.