The Endpoint Activity screens let you quickly isolate, act on, and analyze all the endpoints that are connected or have attempted to connect to your network.

For example, let's say a domain user calls and reports that her laptop has been quarantined. We can quickly find the device on the Endpoint Activity screen, shown here, which displays (1) data on currently connected endpoints and (2) data on all endpoint activity for the previous 30 days. Here, the Connected Endpoints display shows that 5119 endpoints are currently connected, with 512 of them in quarantine.

To find the quarantined device in question we'll begin by opening expanding the Search Criteria (3).