Analytics

You can access reports to track patching progress and identify security gaps. Browse prebuilt reports to analyze your device management data.

Viewing and Filtering Analytics Reports

To view analytics reports, go to Insights → Analytics in the console. These reports include data from all organizations that you have permissions to view.

From the Analytics page, choose the type of reports you want to view from the Select Board list. You can currently select from these boards:

Name of board	Description
Health and Device Status	These reports offer a deep dive into individual device health and status, providing critical insights into update readiness, patching needs, and potential issues for effective troubleshooting.
Organization Insights	These reports provide a comprehensive snapshot of your organization, detailing operating system distribution, licensing, and connection status.
Patch Impact and Performance Reports	This board tells the story around applying patches irrespective of vulnerability, providing actionable reporting around patch activity and predictability on the impact of applying patches within an environment.
Policy Execution	These reports collectively provide a granular overview of policy execution, success, and failure rates across organizations, alongside a detailed breakdown of policy results.
Risk and Mitigation Reports	This board tells the story around applying patches respective of vulnerability, providing actionable reporting around patch activity and predictability on the impact of applying patches within an environment.
Organizational Risk and Patch Trend	This board delivers risk and patch trend data that highlights how a customer's environment is changing over time, how well risk and patches are being addressed and offers more insight into how Automox is helping to remediate and automate tasks.

You can perform the following actions on the different boards:

• Filter: Filter the available reports
• Download PDF: Download the data as a PDF
• Present: Present reports for larger, detailed views
• Schedule: Create a schedule to send a PDF, XLSX, or CSV by email
• Hover: Hover over individual reports to view more information

Filtering Reports

You can apply several filters to refine the data shown in analytics reports.  The available filters depend on the board you select.

The following filters are available:

• Date Last 90 Days: Select a value to filter policy events by. Data beyond 90 days may not be available, even if included in your filter.
• Days Since Last Disconnect: Select to filter by the number of days a device was last disconnected. The default setting is 3 days.
• Device: Select one or more devices to filter by. By default, all devices are selected.
• Group: Select one or more groups to filter by. By default, all groups are selected.
• Install Date Last 90 Days: Select to view analytics based on a rolling install date or a fixed date range. While the date filter allows you to select a wider range, the report will only include up to 90 days of data. Data beyond 90 days from the selected end date may not be available, even if included in your filter.
• Operating System: Select one or more operating systems to filter by. By default, all operating systems are selected.
• Organization: Currently, if you are logged into a specific organization, the reports will show data for all organizations you have permissions to view. Use the Organization filter to include or exclude organizations, depending on your permissions and preferences.
• Package Category: Select from options such as browser, communication, utility, and other. By default, all options are selected.
• Package Name: Select one or more packages to filter by. By default, all packaged are selected.
• Package Source Type: Select from first-party or third-party packages. By default, both are selected.
• Policy: Select one or more policies to filter by. By default, all policies are selected.
• Policy Type: Select one or more policy types (Patch, Required Software, or Worklet) to filter by. By default, all policy types are selected.
• Severity: Use the Severity filter to include or exclude specific CVSS severity levels.
  Note: For more information, see Understanding CVE Scoring and Severity Data.
• Target MTTP: You can change this value. Use this filter to select a target Mean Time to Patch (MTTP) value from 1 through 30.
• Target MTTR: You can change this value. Use this filter to select a target Mean Time to Remediate (MTTR) value from1 through 30.
  See the Glossary section for details.)

Additional Filters

For the Patch and Impact Performance board, you can select from additional filters for groups of reports based on these categories.

• Overview
• Patching Performance
• Patching Drilldown

Available Actions

In addition to the Download PDF button available from the board, you can interact with individual reports using the following actions:

• Explore: Provides access to additional filters and customization options to refine the data further
• Show Underlying Data: Displays the detailed data that supports the report’s metrics
• Download: Exports the report in your preferred format: CSV, PDF, XLSX, or PNG
• Present: Opens the report in a larger, more detailed view for closer inspection
• Alerts: You can select Create alert (bell icon) and Manage alerts. For more information about alerts, see Analytics Board and Report Scheduling.

Managing Customized Views

Any filter modifications you make to the analytics board can be saved in a customized board view. It is possible to add, delete, and manage custom views for yourself.

1. When you modify a filter and apply the change, you will see the option Save view along with the filters. You can apply multiple filters to the same view or create individual custom views.
2. Click Save view and enter a custom name that reflects the new board view.
3. To switch back to the default view, select Reset Liveboard from the drop-down menu.
4. Select Manage views to edit custom view names or delete a custom board view.

Patch Impact and Performance Reports

The reports associated with patch impact and performance are listed here. They are grouped in three categories. Click the areas for details about each report. You can find detailed descriptions for each in Report Calculation Methodology - Security and Patch Performance, select Patch Impact and Performance Reports.

1. Overview 
   • Mean Time to Patch (MTTP)
   • MTTP Achievement
   • Patch Policy Success Rate
   • Patches Applied by Month - MTTP calculation including outstanding patch instances
   • Adjusted MTTP
   • Devices in Scope for Active Patch Policies
   • Packages Up to Date
   • MTTP Trend by Device Count
   • Policies with Highest Execution Count
   • Applied Packages by Patch Instance Count
   • Applied Packages by Device Count
   • Patching Progress by Device Count
   • Outstanding Packages by Device Count
   • Outstanding Packages by Patch Instance
2. Patching Performance
   • Overall Policy Success
   • Patch Policy Execution History
   • Applied Patch Instances by OS Family
   • Patching Progress by Outstanding Patch Instance Count
   • Patch Policy Schedule
   • Patch Policy Executions
3. Patching Drilldown
   • Applied Package History
   • Recently Executed Patching Policies
   • Patching Progress by Outstanding Device Count - Drilldown
   • Outstanding Packages by Device
   • Outstanding Packages by Patch Instance

Risk and Mitigation Reports

The reports associated with risk and mitigation are listed here. You can find detailed descriptions for each in Report Calculation Methodology - Security and Patch Performance, select Risk and Mitigation.

• Mean Time to Remediate in Days (MTTR)
• MTTR Account Achievement - Comparison against Target MTTR
• KEV Vulnerability Instances Remediated - Vulnerability Instances Remediated
• Vulnerability Instances Remediated
• Remediation Trend by Vulnerability Instance
• MTTR Trend vs Number of Devices In Scope
• Projected MTTR
• Active Policies By Projected MTTR
• Top Active CVEs By Exposure In Days
• Vulnerabilities Remediated by Severity
• MTTR Target Breach by Exposure in Days
• Outstanding Vulnerability Instances

Health and Device Status

The reports associated with health and device status are listed here. You can find detailed descriptions for each in Report Calculation Methodology, select Health and Device Status.

• Patch Policies Successful by Month
• Patch Policies Successful
• Devices Requiring Restart
• Not Compatible Device Count
• Last Scan Failed by Device Count
• Outstanding Patch Instances
• Outstanding Patch Instances
• Patch Instances Requiring Restart
• Outstanding Critical Patch Instances
• Outstanding Patch Instances by CVSS Severity
• Device Health by Group
• Devices Not Compatible
• Outstanding Critical Patches by Organization and Group
• Devices Requiring Restart by Organization and Group
• Last Scan Failed by Organization and Group

Organization Insights

The reports associated with organization insights are listed here. You can find detailed descriptions for each in Report Calculation Methodology, select Organization Insights.

• Subscription
• Device Count
• Max Device Count
• Devices Deployed
• Group Count
• Recently Added Devices
• Deployment Trend by Day
• Environment by OS
• Connection Status by Device Count
• OS Distribution
• Disconnected Devices 1–30 Days
• Disconnected Devices 31–60 Days
• Disconnected Devices 61–90 Days
• Disconnected Devices Greater than 90 Days
• Disconnected Devices Breakdown

Policy Execution

The reports associated with health and device status are listed here. You can find detailed descriptions for each in Report Calculation Methodology, select Policy Execution.

• Policy Success Rate
• Policy Executions by Month
• Unique Policy Executions
• Policy Count
• Active Policy Count
• Unscheduled Worklets with Associated Groups
• Policy Execution Status by Date
• Policy Success Rate by Type
• Policy Count by Type
• Policy Successes and Failures by Type
• Scheduled Policies by Type

Organizational Risk and Patch Trend

The reports associated with Organizational Risk and Patch Trend are listed here. You can find detailed descriptions for each in Report Calculation Methodology – Organizational Risk and Patch Trend.

• Risk Reduction Trend
• Net Patch Instance Delta
• KEV Reduction Trend
• Average Days Risk Exposure by Month
• Net Risk Delta
• Risk Score by CVSS Severity
• Remediation Vulnerability Instances by CVSS Severity
• Patch Instance Trend by Day
• Average Exposure Days by CVSS Severity
• Critical Vulnerability Instance Trend by Device Count

Understanding CVE Scoring and Severity Data

Automox Analytics reports include CVE and CVSS Severity information to help you interpret vulnerabilities more effectively.

CVSS Score

The CVSS Score is a numerical value from 0 to 10 that represents a qualitative measure of severity.

Automox Analytics displays the most current score available in this priority order:

• CVSSv4
• CVSSv3
• CVSSv2

If no CVSS score is available, the system displays NULL.

CVSS Severity

The CVSS Severity is a text (string) representation of the numerical CVSS range that reflects the most recent severity available. If no severity is available, the value will be NONE.

Report Calculation Methodology

To support accurate interpretation of analytics data, this section provides the calculation methodology for each report. Reports are grouped into categories based on their focus areas:

• Report Calculation Methodology - Security and Patch Performance: Includes the Patch Impact and Performance and Risk and Mitigation boards. These boards focus on patching activity and effectiveness, with or without a vulnerability context.

• Report Calculation Methodology - Operational Insights\: Includes the Health and Device Status, Organization Insights, and Policy Execution boards. These boards provide operational visibility into devices, policies, and organization-level metrics.
• Report Calculation Methodology – Organizational Risk and Patch Trend This board focuses on tracking changes in risk exposure, vulnerability remediation, and patch activity over time.

Additional boards will be added over time, and each will include its own methodology section as applicable.

Report Calculation Methodology - Security and Patch Performance

This section explains how analytics calculates metrics for each report using defined formulas and associated variables.

• Patch Impact and Performance
• Risk and Mitigation

Report Calculation Methodology - Operational Insights

This section explains how analytics calculates metrics for each report using defined formulas and associated variables.

• Health and Device Status
• Organization Insights
• Policy Execution

Report Calculation Methodology – Organizational Risk and Patch Trend

This section provides the calculation methodology for the Organizational Risk and Patch Trend board. These reports focus on tracking changes in risk exposure, vulnerability remediation, and patch activity over time.

Risk Reduction Trend

• Variables: Vulnerability Instances, Date, CVSS Severity
• Description: Displays a KPI chart showing the change in vulnerability instances between the current month and the previous month.

Net Patch Instance Delta

• Variables: Sum of the net change patch instances, Date
• Description: Displays a KPI chart showing the sum of all changes for patch instances by comparing the current month to the previous month.

KEV Reduction Trend

• Variables: Max In Kev for time period, Date
• Description: Displays a KPI chart showing the change in Known Exploitable Vulnerability (In KEV) instances between the current month and the previous month.

Average Days Risk Exposure by Month

• Variables: Average number of exposure days, Date
• Description: Displays KPI chart showing the average number of days vulnerabilities were exposed in the environment, comparing the current month to previous months.

Net Risk Delta

• Variables: Sum of the net change in risk, Date
• Description: Displays a KPI chart showing the sum of all changes for risk using CVSS scores comparing the current month to the previous month.

Risk Score by CVSS Severity

• Variables: Risk Score, Date, CVSS Severity
• Description: Displays an area chart showing the trend of Risk sliced by CVSS severity.

Remediation Vulnerability Instances by CVSS Severity

• Variables: CVSS Severity, Remediated Vulnerability Instances
• Description: Displays a bar chart showing the number of vulnerability instances that were remediated, broken down by CVSS severity using the board’s date filter.

Patch Instance Trend by Day

• Variables: Patch Instance Count, Date
• Description: Displays an area chart showing the daily trend of patch instances over time.

Average Exposure Days by CVSS Severity

• Variables: CVSS Severity, Date, Average Days Exposed
• Description: Displays a stacked area chart showing the trend of days exposure for vulnerability instances affecting in-scope organizations.

Critical Vulnerability Instance Trend by Device Count

• Variables: Vulnerability Instances, Date, Device Count
• Description: Displays an area chart showing the vulnerability instance trend over time along with a device count over time to view the relationship between vulnerability instance counts compared to the device count.

Strategies for Improving Metrics

You can use insights from the reports to take targeted actions that reduce risk and improve your organization's performance against key metrics. This section provides a few examples to illustrate how to interpret report data and act on it.

• Active Policies By Projected MTTR: This report helps you identify policies with large gaps between scheduled runs. If you notice long intervals for certain policies, consider adjusting their schedules to reduce patching delays. Reducing the time between executions can help you get ahead of vulnerabilities and decrease your overall MTTR.
  

• Outstanding Vulnerability Instances: Use this report to determine if there’s a high number of unresolved vulnerabilities—in the following example we show those with High or Medium severity. If your environment shows elevated counts for these severities, you may need to refine your policies to target them more aggressively and close the gap on remediations.
  

• MTTR Account Achievement: This report helps you monitor whether your remediation efforts align with the Target MTTR Parameter. If the percentage is low, focus on reducing delays in the patch deployment cycle and consider streamlining approvals or improving device readiness.
  

Glossary

• Known Exploitable Vulnerability (KEV): A CVE (Common Vulnerabilities and Exposures) that has documented evidence of active exploitation in the wild. These vulnerabilities are typically listed in authoritative sources such as the CISA KEV catalog and represent higher risk due to confirmed use in real-world attacks.
• Key Performance Indicator (KPI): The term KPI refers to metrics used to evaluate progress or change over time. Each KPI chart described compares values across time periods or categories to highlight trends in patching and risk reduction

• Vulnerability Instance: A specific occurrence of a security vulnerability (CVE) on a device or package. Device, Package, Version, and Install Date (historical trend) are attributes that make up this occurrence

Formula	Definition
Day Diff	diff_days ( Install Date , Created At )
Days Exposed	diff_days ( CURRENT DATE, Created At )
Remediation Count	Unique count ( Vulnerability Instance)
MTTP	sum ( Day Diff ) / Package Count
MTTP Achievement	Target MTTP / MTTP
MTTR	sum ( Day Diff ) / Remediation Count
MTTR Achievement	Target MTTR / MTTR
Package Count	Count ( Package Version ID )
Success Rate	Policies Succeeded / Total Policy Executions
In Scope Policy Devices	Total Active Patch Policy Devices / Total Devices
Fully Patched Percentage	Fully Patched Package Count / Total Package Count

CVE Legend

CVSS scores are mapped to the following severities:

Severity	Severity score range
Critical	9–10
High	7–8.9
Medium	4–6.9
Low	0.1–3.9
None	0.0

Related Topics

• Analytics Board and Report Scheduling
• Creating Reports
• Policy Results Report
• Data Extracts
• Automox Console API: Create a new Data Extract