If you deleted a sensor from the web but not uninstalled it on the host, the deleted_sensor event will let you know when it is trying to connect but being rejected. See our technical documentation for more.
How do I know if an EDR sensor was removed, but still has the service running and reaching out?
Written by Ross. Updated over a week ago
Did this answer your question?