The sensor-cull service performs continuous cleaning of old sensors that have not connected to your organization in a number of days. Note that the sensor will not reinstall automatically but it can be restored by issuing an action as described below.

When a sensor that was previously deleted from an Organization attempts to connect to the LimaCharlie cloud, LimaCharlie will produce a deleted_sensor event.

This gives you the ability to allow the sensor to rejoin the fleet. To do it automatically, you can create a D&R rule detecting the deleted_sensor event and responding with an:

- action: undelete sensor

Did this answer your question?