Product guide

Security Reports

Report on endpoint security, incidents, vulnerabilities, policy coverage, and fleet health for a defined period.

What a Security Report Is#

A security report describes the security state of the fleet over a period. It is the operational counterpart to a compliance report: where compliance asks whether controls exist, a security report asks whether they are working.

The most common mistake is reading a single total. A report is useful when it is compared with the same report for the previous period, with the same scope.

Security and vulnerability posture report — CVE tracking, policy drift, certificate expirations, and protection coverage.

Report Types#

Seven report families cover the operational security questions:

Report type	What it contains
Endpoint security baseline	Firewall, encryption, antivirus and secure boot state per device, with agent version coverage and disk capacity headroom.
Exposure and vulnerabilities	CVE inventory, known exploited vulnerabilities, endpoint exposure scores and the software to CVE matches behind them.
Threat and behavior	Alert register with severity and resolution state, process execution, shell history, DNS queries and shadow AI use.
Data loss incidents	DLP incidents by channel and classification, the enforcement action that was taken and the users generating most violations.
Asset and persistence	Local administrator accounts, logon activity, and scheduled tasks, startup programs and services flagged as suspicious.
Policy coverage and drift	Configuration drift, policy synchronization state and control coverage across the fleet.
Fleet health	Endpoints that stopped reporting, connectivity, buffered offline telemetry and endpoints awaiting a reboot.

Policy coverage finds the blind spot

Every other report describes what the platform is doing. Policy coverage is the one that tells you what the platform is not doing.

Filters#

Date range - set it explicitly; it is what makes two reports comparable.
Target scope - limit the report to the groups, profiles, or tags the audience owns.
Severity - exclude informational items from a management report, but keep them for an engineering review.
Module - include only the modules relevant to the question being answered.

Exporting#

1
Set the scope and period
Define both before you generate. Changing them afterwards means the exported file no longer matches the report it came from.
2
Generate the report
The report is built from live platform data at the moment it is generated, so generate it when you need it rather than keeping a stale copy.
3
Review the summary against detail
Check that the totals match the detail records. A mismatch usually means a filter is applied to one and not the other.
4
Export and store with its scope
Keep the period and scope with the exported file so a later reader can interpret it correctly.

Frequently Asked Questions#

What is the most useful filter?

The date range. A security report without one cannot be compared with the next report, which removes most of its value.

Should I report on the whole fleet?

Only when the audience needs the whole fleet. For a team review, scope the report to that team’s groups so the output is short enough to act on.

How do I show improvement?

Generate the same report for consecutive periods with the same scope. The change between them is the improvement, not the absolute number.

Can I report on endpoints outside any policy?

Yes. Policy coverage reporting exists specifically to find endpoints that no policy targets, which is a common and easily missed gap.