How to analyse endpoint health trends

​

Procedure

1. Open the Endpoints page .
2. Locate the endpoint you want to investigate.
3. Click the endpoint to open the Endpoint details page.
4. Review the Endpoint Health Trends widget. The Endpoint Health Trends widget is a heat map that visualizes changes in endpoint health over time.
   • Each row represents a day.
   • Each column represents an hour.
   • Cell colors indicate the lowest health level detected during the corresponding hour.
   • Gray cells indicate periods when the endpoint was offline. The widget header displays:
   • The current endpoint health score and the most recent health update time are displayed.
   • Use the date navigation controls to browse historical health data in 7-day intervals. Historical health information is retained for up to two years from the most recent health check.
5. After the Endpoint Health Trends widget analyses, in the upper-right corner, click History to open the Endpoint history page.
6. Review the Health Changes History widget:
   • The line chart displays how the endpoint health score has changed over time.
   • By default, the chart displays a continuous line. Periods during which the endpoint was offline are extrapolated between available data points.
   • Enable the Display intervals with no data toggle to visualize periods when no telemetry was received from the endpoint.
   • Select an area of the chart to zoom in and review specific time periods in greater detail.
   • Click the chart to zoom out.
7. Pay special attention to significant increases or decreases in health score. Such changes may be caused by:
   • New risk factors becoming active
   • Existing risk factors being remediated
   • Policy assignments or removals
   • Changes in endpoint configuration or security posture
   • Newly collected probe results
8. Review the Policy Changes History grid to identify when policies were assigned to or removed from the endpoint.
9. Compare policy assignment changes with the health score timeline to determine whether a health change was caused by policy changes or by actual endpoint conditions.
10. Review the Risk Factors History grid to see the history of status changes for all risk factors on the endpoint.
11. For event-based risk factors, the grid also displays a new record for each event that caused the risk factor score to change.

​

Key Considerations

• Health score changes should always be reviewed together with policy and risk factor history to understand their root cause.
• Large health score decreases often indicate newly detected risks, while large increases typically result from remediation activities.
• Policy assignments may affect endpoint health even when the endpoint configuration itself has not changed.
• Event-based risk factors can generate multiple history records as new events are detected and processed over time.

​

Related