What Security Activity Looks Like
After a device is enrolled, security and maintenance activity begins automatically in the background. This guide explains what that activity looks like in the Dashboard and how to interpret it.
Seeing ongoing activity is normal and expected. It indicates that the system is actively monitoring and protecting your devices.
Background Security Activity
Once installed, the agent continuously performs routine security and maintenance tasks.
These tasks may include checking for updates, monitoring system health, scanning for threats, and confirming that protection services are running correctly.
Most of this activity does not require any action and completes silently.
Antivirus and NGAV Activity
For Organizations with advanced security enabled, antivirus and next-generation antivirus tools actively monitor device behavior.
You may see activity related to:
- Regular security scans.
- Threat detection or prevention events.
- Automated response actions taken to contain or remediate threats.
In many cases, threats are handled automatically and resolved before any manual intervention is needed.
Patching and Maintenance Events
Security activity also includes routine maintenance, such as operating system and software patching.
You may see activity showing:
- Patch scans being run.
- Updates being installed.
- Pending reboots when required to complete updates.
These events are part of keeping devices secure and up to date.
Where Activity Appears
Security and maintenance activity is visible in several places:
- The Dashboard summary and snapshot metrics.
- The device details page, under Activities and related sections.
- Alerts, when attention is required.
Not all activity generates alerts. Alerts are reserved for conditions that may require review.
Normal vs. Concerning Activity
Routine activity, such as scans, updates, and completed jobs, is normal and expected.
Repeated alerts, unresolved threats, or devices consistently marked as unhealthy may indicate issues that should be reviewed.
The goal of the system is to handle most security activity automatically while providing visibility when attention is needed.
What to Do Next
If security activity appears normal and devices are healthy, no action is required.
If alerts persist or activity appears unusual, reviewing the device details or contacting support can help clarify what is happening.
Seeing ongoing security activity is a sign that protection is working as intended.