When the Symantec Endpoint Protection Daily Status report is run from within the Symantec Endpoint Protection Manager 12.1 RU2 (SEPM), the Virus Definition Distribution sorts definition distribution into the following groups:
Less than 24Hrs
Greater than 1 Days
Greater than 3 Days
Greater than 7 Days
Next to "Less than 24 Hrs", there are parentheses which show how many computers have updated definitions within the last twenty-four hours. When this list is expanded using the drop-down arrow, the number show in parentheses does not match the number of computers shown in the list.