How to Deregister/Remove a Sensor from Pulse

If there is a desire to move a sensor from its initial network subnet it is deployed within to a new, different network subnet, it is required to deregister then sensor beforehand. Only after the sensor has been properly deregistered, should the sensor be moved to the new network and registered for use with the new network.

How to Deregister a Sensor from Pulse

Deregistering a sensor from Pulse is a simple process. The first step is performed from the sensor itself. The second step, which is optional depending upon whether the data discovered by the sensor is to be retained within Pulse, is performed from within Pulse.

First Step

Establish either an SSH connection (or a reverse SSH connection) to the sensor and login with the "pwnie" user account.
Type sudo su and press Enter, then re-type the password to become superuser.
Next, type px-deregister-dispatch and press Enter.
When prompted, select Yes to continue. With the exception of its network configuration, various configuration-related files and logs will be removed from the sensor. As a result, it may take several minutes to complete.
When returned to the "#" prompt, type reboot and press Enter to reboot the sensor.
After the sensor has been rebooted, it is ready to be moved to the new network subnet intended.

At this time, all of the wired and wireless assets discovered by the sensor in the initial network as well as all threats, alerts, and so on will be retained within Pulse, reflecting their last state of discovery and information learned.

In most use cases, it will be desired to remove all of the learned data from Pulse, allowing the process to start over when the sensor is deployed to a new, different network. To accomplish this, proceed to Step Two outlined below.

In some use cases, it may be desired to retain all of the learned data within Pulse. However, when the sensor is configured and deployed to a new, different network, it is required to specify the sensor name (when registering it to Pulse) differently from what the sensor name was when it was deployed in the initial network. In this use-case, all assets and data discovered in the new, different network will be reflected within the same Pulse environment, but attributed to the latest sensor name specified.

Step Two

Login to Pulse and go to the Sensors page.
Select the sensor to be removed from Pulse.
Select Settings at the top of the pop-up window, then click the Deregister button in the upper-right corner.
Enter your password to remove the sensor from Pulse.
At this time, all assets and data discovered will begin to be removed from Pulse. Depending on the volume of data, this process may take several minutes.

_Copyright

_{© 2024 Outpost24® All rights reserved.}_{This document may only be redistributed unedited and unaltered. This document may be cited and referenced only if clearly crediting Outpost24® and this document as the source. Any other reproduction and redistribution in print or electronically is strictly prohibited without explicit permission.}

_Trademark

_{Outpost24® and OUTSCAN™ are trademarks of Outpost24® and its affiliated companies. All other brand names, product names or trademarks belong to their respective owners.}