> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How to analyse endpoint health trends

> Review historical endpoint health trends, policy assignment changes, and risk factor activity to understand how an endpoint's security posture has evolved over time.

## Procedure

1. Open the [Endpoints page](/docs/espm/endpoints/endpoints-page) .
2. Locate the endpoint you want to investigate.
3. Click the endpoint to open the  [Endpoint details](/docs/espm/endpoints/endpoint-details)  page.
4. Review the **Endpoint Health Trends** widget. The **Endpoint Health Trends** widget is a heat map that visualizes changes in endpoint health over time.
   * Each row represents a day.
   * Each column represents an hour.
   * Cell colors indicate the lowest [health level](/docs/espm/endpoint-security-posture-and-health-score#health-rating-scale) detected during the corresponding hour.
   * Gray cells indicate periods when the endpoint was offline. The widget header displays:
   * The current endpoint health score and the most recent health update time are displayed.
   * Use the date navigation controls to browse historical health data in 7-day intervals. Historical health information is retained for up to two years from the most recent health check.
5. After the **Endpoint Health Trends** widget analyses, in the upper-right corner, click **History** to open the  [Endpoint history](/docs/espm/endpoints/endpoint-history)  page.
6. Review the **Health Changes History** widget:
   * The line chart displays how the endpoint health score has changed over time.
   * By default, the chart displays a continuous line. Periods during which the endpoint was offline are extrapolated between available data points.
   * Enable the **Display intervals with no data** toggle to visualize periods when no telemetry was received from the endpoint.
   * Select an area of the chart to zoom in and review specific time periods in greater detail.
   * Click the chart to zoom out.
7. Pay special attention to significant increases or decreases in health score. Such changes may be caused by:
   * New risk factors becoming active
   * Existing risk factors being remediated
   * Policy assignments or removals
   * Changes in endpoint configuration or security posture
   * Newly collected probe results
8. Review the **Policy Changes History** grid to identify when policies were assigned to or removed from the endpoint.
9. Compare policy assignment changes with the health score timeline to determine whether a health change was caused by policy changes or by actual endpoint conditions.
10. Review the **Risk Factors History** grid to see the history of status changes for all risk factors on the endpoint.
11. For event-based risk factors, the grid also displays a new record for each event that caused the risk factor score to change.

## Key Considerations

* Health score changes should always be reviewed together with policy and risk factor history to understand their root cause.
* Large health score decreases often indicate newly detected risks, while large increases typically result from remediation activities.
* Policy assignments may affect endpoint health even when the endpoint configuration itself has not changed.
* Event-based risk factors can generate multiple history records as new events are detected and processed over time.

## Related

<CardGroup cols={2}>
  <Card title="How to investigate risk factors" icon="workflow" href="/docs/espm/howto/how-to-understand-risk-root-cause">
    Investigate risk factors affecting an endpoint, review available technical details, and understand the underlying conditions or activities that caused a risk to be detected.
  </Card>

  <Card title="How to investigate and remediate event-based risks" icon="workflow" href="/docs/espm/howto/how-to-remediate-event-based-risk-factors">
    Investigate event-based risk factors and implement corrective actions to eliminate their root cause and reduce the likelihood of recurrence.
  </Card>
</CardGroup>