Within the appliance console of Symantec Endpoint Detection and Response (SEDR), the Executive report does not show "Recently" infected endpoints:
If the number of infected endpoints goes beyond 2000 in the last 30 days, only the first page (of page size 2000) is being plotted.
The report is not paginated hence any record exceeding 2000 is not captured in the report.
Steps to reproduce
The no of Infected Endpoint should be greater than 2000 in the last one month.
Generate Executive Report and check chart under Recently Infected Endpoints
The chart should show only 2000 infected endpoints uptill that day.
Symantec Engineering commits to change this behavior in an upcoming build. The new behavior will be that the charts paginate and plot the graph for the last 30 days irrespective of the infected endpoint count.