Unpairing Sensor from Brain

Safely unpair a Sensor from a Brain and clean up pairing state.

Introduction

Unpairing is the process of removing the sensor and brain association. The sensor unpairing may be required in case of :

1. Brain migration to new IP.

2. The sensor is being returned to Vectra.

Related Links:

• Pairing Physical Sensors

• How do I clear data from a Vectra Cognito brain or sensor before returning the appliance?

Preparation:

1. You can see the list of paired sensors and the list of sensors available for pairing from the "brain_web_UI -> Data Sources -> network -> Sensors": Note: On Cognito Detect Version 7.3 and below: Manage → Sensors: The status column indicates whether the sensor has been paired (i.e. Forwarding / Not-forwarding) or is available for pairing (i.e. Provisioned / Pairing). Sensors that have been paired with other brain devices are not listed on this screen.

Steps:

From the UI

1. Go to "Brain_Web_UI -> Data Sources -> Network -> Sensors".

2. Hover the cursor over the sensor you want to unpair; to see the unpair icon (Marked with a red border in the below picture). Click on it.

3. The pop-up show like the below screen. Click on the "Unpair Sensor" button The status of sensor will chnage to unpairing.

4. Wait for approx 5 minutes; the sensor status should chage to "Provisioned" .

5. There may be situations when the brain is not able to reach the sensor; in that case:

   1. Click on unpair button again.

   2. The pop-up will appear . Click on "Force Unpair Sensor". If the sensor is a Virtual Sensor, just delete the sensor image; and if it's a physical sensor then login to sensor VCLI as a 'vectra' user, and run the command

      show brain
      del brain
      show brain

      The sensor unpairing is complete now.

From CLI

1. To list the sensor:

   show sensors

2. Now, to unpair (replace [SERIAL] by the sensor serial number):

   sensor unpair [SERIAL]

3. In special cases, for example, if a virtual sensor was deleted from the host before unpairing it, you will can force the removal:

   sensor unpair --force [SERIAL]

Unpairing Cloud Sensor:

1. Login to the QUX/RUX portal > Data sources > Select cloud sensor (AWS CloudTrail, Azure AD & M365) and expand it.

2. Click on the “Delete” icon

3. It will ask for the confirmation page, select “Remove Connection”

4. Wait for 2 minutes, and the cloud sensor will disappear.

Verification:

1. The Sensor state should be at the 'Available' state at "Brain_Web_UI -> Data Sources -> Network -> Sensors".

2. In the case of the Physical Sensor, the following VCLI command should give <blank> result.

   show brain

Troubleshooting:

If prerequisites are passing then sensor pairing can go as easily as it can be; however in case of any issue please contact Vectra support. If possible, please add the following information to the ticket:

1. Output of VCLI commands on Sensor:

show serial-number
show version
show brain
show interface

1. Output of VCLI commands on the brain:

show serial-number
show version
show interface

3. Screenshot of sensor detail at: "brain_web_UI -> Data Sources -> Network -> Sensors"; then scroll to the sensor in the subject and click on the tree.