Why the Daily Compliance Email and the Live Dashboard Disagree
A compliance report emailed daily at 06:00 shows 94.2% of 18,000 endpoints have the required patch. The live dashboard shows 89.5%. The report is generated from a saved question with a filter Is Virtual = false and computer group Managed Windows. The dashboard uses the same saved question but is viewed by a team whose persona is scoped to the computer group Managed Windows - Pilot (1,200 endpoints). The report includes endpoints last seen up to 45 days ago; the dashboard excludes clients not seen in 7 days. The patch sensor returns Not Installed when the registry key is missing and Unknown when the scan fails; the report counts Unknown as compliant, while the dashboard counts Unknown as non-compliant.
1. Identify the largest causes of the gap and how you would prove each.
Read the worked answer
There are at least four differences: population (45-day last-seen vs 7-day), scope (Managed Windows vs Pilot subgroup), treatment of Unknown (compliant vs non-compliant), and timing (06:00 report snapshot vs live dashboard). The last-seen difference alone can move a percentage because stale endpoints often have old compliant state. Prove each by re-running the report with the dashboard's 7-day exclusion, then with the pilot group, then with identical Unknown handling. Compare row counts at each step; the residual gap is timing or sensor behavior. Do not argue about the percentage until the denominator and the Unknown rule are aligned.
2. Which definition should be used for the official compliance number, and why?
Read the worked answer
The official number should state its population, last-seen rule, and Unknown rule explicitly. For compliance, Unknown is not evidence of compliance; count it as non-compliant or report it separately as an uncovered population. Stale endpoints should be reported separately, not silently counted as compliant. If the business wants a 'managed population' metric, use 7-day last-seen and show stale endpoints as a separate risk count. Whichever rule is chosen, the report and dashboard must use the same rule; otherwise the daily email and the live view will always disagree.
3. What monitoring cadence and thresholds would you set?
Read the worked answer
Daily report for the official number with explicit denominator and Unknown count; hourly or on-demand dashboard for operational triage, labeled as live and scoped. Alert when compliance drops more than 2 points week over week, when Unknown exceeds 5% of the population, or when endpoints not seen in 7 days exceed an agreed threshold. Track stale endpoints separately. Include a reconciliation check that the report and dashboard use the same saved-question revision and computer group. Review thresholds monthly, because a 1,200-endpoint pilot and an 18,000-endpoint estate need different noise tolerances.