The Active Endpoints count is showing a different number of clients than the SEPM's Total Endpoints count and/or the Enrolled clients count in the Entities tab.

The Active Managed Endpoints count is the number of Symantec Endpoint Protection endpoints that incurred any type of event activity within the last 96 hours (4 days). This activity may be suspicious, malicious, or benign reputation checks.

As the Active Managed Endpoint total represents only those endpoints with recent activity, you must refer to your Symantec Endpoint Protection Manager for a total of all endpoints, which uses a different set of criteria.

There is no expectation that the Active Managed Endpoints count in SEDR will match any other metric.