Endpoints widget in OneView

Active Detections: Displays the number of endpoints with active detections that require remediation. This is prompted by un-remediated endpoints which have Found detections.

Recommendation: 

• Use the Actions > Remediate Endpoint(s) action on the Endpoints page.
• Quarantine, or Ignore & Create an exclusion from the Active Detections page in the Detection Center.
• If the item does not Quarantine, investigate and manually delete e.g., it may be on a protected file share.

Restart required: Displays the number of endpoints that need a system reboot. Endpoints must reboot to complete remediation or make changes to the software.

Recommendation:

• Reboot using the OneView Console Actions or on the endpoint manually.
• Automatic updates: For workstations, consider setting Policy under Endpoint agent settings, check mark the Automatically download and install application updates, and Allow users to postpone updates

Needs attention: Displays the number of endpoints that are not configured correctly or have problems. 

Recommendation: Hover over the icon to display the specific error. For more information on these errors, see Endpoint shows needs attention indicator in OneView.

Scan needed: Displays the number of endpoints that have not scanned within the last 7 days, including not having a first scan. Regular scans are important to keep endpoints free of threats. Endpoints will scan autonomously, and offline, but need to connect to return scan results.

Recommendation:

• Check that scheduled scans have the correct Groups assigned.
• Enable the Run missed scans as soon as possible option in scheduled scans.
• Run a manual Scan + Quarantine from the Endpoints page. 

Suspicious activity: Displays the number of endpoints with suspicious activities found. Investigate suspicious activity to keep your endpoints protected. Your site(s) must have the Endpoint Detection and Response product to use this feature.

Recommendation: After investigating, click the Remediate or Close Incident options.

Endpoints isolated: Displays the number of isolated endpoints. Isolation stops threats from spreading between endpoints by restricting their communication or access. Your site(s) must have the Endpoint Detection and Response product to use this feature.

Recommendation: After resolving the endpoint issue, click the Remove Isolation option.

Last sync 7+ days ago: Displays the number of endpoints not seen by the OneView console for 7 or more days.

Recommendation:

• In the Policy settings, check mark Enable service health monitoring.
• Restart the Endpoint Agent service on the endpoint.
• Investigate network connectivity. 
  • Use Endpoint Agent Command line utility to test connections: EACMD.EXE --testconnections

Agent update available: Displays the number of endpoints that need an agent update. 

Recommendation:

• Manual updates: In the Actions menu, click Install Agent Updates.
• Automatic updates: For workstations, consider setting Policy under Endpoint agent settings, check mark the Automatically download and install application updates, and Allow users to postpone updates.