When performing Endpoint Search on ATP it might be observed the number of endpoints is far less than reported by SEPM or even by ATP active endpoints widget.
This issue has been addressed in ATP2.3. Please upgrade to this build at earliest convenience.