The sensor-cull service performs continuous cleaning of old sensors that have not connected to your organization in a number of days. Note that the sensor will not reinstall automatically but it can be restored by issuing an action as described below.
When a sensor that was previously deleted from an Organization attempts to connect to the LimaCharlie cloud, LimaCharlie will produce a deleted_sensor event.
This gives you the ability to allow the sensor to rejoin the fleet. To do it automatically, you can create a D&R rule detecting the deleted_sensor event and responding with an:
- action: undelete sensor