In progress can mean that some endpoint searches are complete, while others are in varying states.
Hover over the progress bar in the Status column and a dialog box with the current status of your search appears.
The search was canceled (manually or the search timed-out).
Searches that are in progress but do not complete timeout 7 days after they are initiated.
The search failed to complete on all endpoints (the endpoint search and the endpoint data recorder search, if applicable).
Go to the Search Status tab on the Search details page to see the status of the search per endpoint. This tab also provides more information regarding why a search failed.
This icon does not appear unless both search types (endpoint search and endpoint data recorder search, if applicable) are complete.
The search is completed on all endpoints to the extent possible (that is, the search completed, failed, or timed-out). But there is at least one endpoint that has more data that it cannot send to ATP.
The search is complete on all of the endpoints to the extent possible (that is, the search completed, failed, or timed-out). And at least one endpoint was able to complete at least one type of search (either the endpoint search or the endpoint data recorder search).