+34 900 840 407
support@cytomic.ai

How does the Automatic Deletion of computers work in products based on Advanced EPDR/EDR?

Related Products_
  • Advanced EPDR
  • Advanced EDR
Introduction

This feature releases the security software license from protected computers and removes them from the console. Computers whose license you want to release must meet certain conditions defined in a filter you must create before enabling the feature. After you have created the filter, it is applied periodically.

Required permissions

Automatic deletion of computers is visible to all users of the web console. However, to configure and modify this feature, the user must have full visibility into all computers and the Add, discover, and delete computers permission.

Consequences of deleting computers

When you delete a computer:

  • The computer and all its information are deleted from the console.
  • The computer is unprotected.
  • If the computer was encrypted, it remains encrypted but you cannot get the recovery keys.

The information generated by a protected computer is not permanently deleted from the Cytomic EPDR servers: If you reassign a license to the computer and it reconnects to the Cytomic server, all its information reappears in the web console. Nevertheless, if the filter is not disabled, the computer will be deleted again the next day.
Notes:

  • Computers are deleted once a day, between 01:00 AM and 03:00 AM UTC.
  • We recommend that you turn off a computer after it is deleted. Otherwise, it will reappear in the web console as soon as it reconnects to the Cytomic servers.
Creating a filter to delete computers

To create a filter that finds computers not connected to the Advanced EPDR/EDR server, use the following parameters:

  • Category: Computer
  • Property: Last connection
  • Operator:
    • Is between (finds computers not connected to the server between two specificdates)
    • Before (finds computers not connected to the server before a specific date)
    • After (finds computers not connected to the server after a specific date)
Enabling the feature
  • Select the Settings menu at the top of the console. Select Computer maintenance from the side menu.
  • Click the Enable automatic deletion of computers toggle.
  • From the drop-down menu, select the filter you want to apply.
  • Click Save changes (You cannot modify or delete the filter during its execution).
Scheduled reports of the computers to be deleted

You can schedule the automatic sending of a periodic report containing a list of computers to be deleted.