{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/",
        "slug": "dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/"
        },
        "title": "Decode endpoint analytics export sentinels before calculating summaries",
        "summary": "Which exported analytics values are status markers rather than ordinary measurements?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:29:23+00:00",
        "modified_at": "2026-09-10T00:55:35+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 1,
        "word_count": 217,
        "potentially_affected": "Apply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.",
        "dse_recommendation": "Write a column contract before importing the export into a spreadsheet or reporting job.",
        "primary_source": {
            "name": "Troubleshooting Endpoint Analytics - Microsoft Intune | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Endpoint analytics exports can encode values differently from the portal. Application usage duration and mean time to failure use minutes; a mean-time-to-failure value of 2147483647 means no crash events. Several startup-time columns use seconds. In the per-device score export, -1 or -2 means the associated score is unavailable, not a measured score below zero. <a href=\"https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.</p>\n<h2>DSE recommendation</h2>\n<p>Write a column contract before importing the export into a spreadsheet or reporting job. Preserve the raw value, its unit, and any separate status meaning. Exclude unavailable markers from numerical summaries under an explicit rule, and represent no-crash observations distinctly from a large measured duration. Have the report owner review these choices before publishing rankings or averages.</p>\n<h2>Verification</h2>\n<p>Test the transformation with records representing an ordinary measured value, an unavailable score, and the documented no-crash marker. Compare each transformed value with its portal meaning and check time-unit conversions independently. Inspect the resulting summaries for implausible extremes and unintended zero substitution. Retain the report name, export period, transformation rules, and sanitized example rows so another analyst can reproduce the result without reverse-engineering an unexplained chart.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Troubleshooting Endpoint Analytics</a>.</p>",
        "content_text": "Source facts\nEndpoint analytics exports can encode values differently from the portal. Application usage duration and mean time to failure use minutes; a mean-time-to-failure value of 2147483647 means no crash events. Several startup-time columns use seconds. In the per-device score export, -1 or -2 means the associated score is unavailable, not a measured score below zero. Microsoft Learn.\nApplicability\nApply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.\nDSE recommendation\nWrite a column contract before importing the export into a spreadsheet or reporting job. Preserve the raw value, its unit, and any separate status meaning. Exclude unavailable markers from numerical summaries under an explicit rule, and represent no-crash observations distinctly from a large measured duration. Have the report owner review these choices before publishing rankings or averages.\nVerification\nTest the transformation with records representing an ordinary measured value, an unavailable score, and the documented no-crash marker. Compare each transformed value with its portal meaning and check time-unit conversions independently. Inspect the resulting summaries for implausible extremes and unintended zero substitution. Retain the report name, export period, transformation rules, and sanitized example rows so another analyst can reproduce the result without reverse-engineering an unexplained chart.\nOfficial references\nMicrosoft Learn: Troubleshooting Endpoint Analytics.",
        "content_markdown": "## Source facts\n\nEndpoint analytics exports can encode values differently from the portal. Application usage duration and mean time to failure use minutes; a mean-time-to-failure value of 2147483647 means no crash events. Several startup-time columns use seconds. In the per-device score export, -1 or -2 means the associated score is unavailable, not a measured score below zero. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot).\n\n## Applicability\n\nApply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.\n\n## DSE recommendation\n\nWrite a column contract before importing the export into a spreadsheet or reporting job. Preserve the raw value, its unit, and any separate status meaning. Exclude unavailable markers from numerical summaries under an explicit rule, and represent no-crash observations distinctly from a large measured duration. Have the report owner review these choices before publishing rankings or averages.\n\n## Verification\n\nTest the transformation with records representing an ordinary measured value, an unavailable score, and the documented no-crash marker. Compare each transformed value with its portal meaning and check time-unit conversions independently. Inspect the resulting summaries for implausible extremes and unintended zero substitution. Retain the report name, export period, transformation rules, and sanitized example rows so another analyst can reproduce the result without reverse-engineering an unexplained chart.\n\n## Official references\n\n[Microsoft Learn: Troubleshooting Endpoint Analytics](https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Decode endpoint analytics export sentinels before calculating summaries",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/",
                "headline": "Decode endpoint analytics export sentinels before calculating summaries",
                "description": "Which exported analytics values are status markers rather than ordinary measurements?",
                "abstract": "Which exported analytics values are status markers rather than ordinary measurements?",
                "articleBody": "Source facts\nEndpoint analytics exports can encode values differently from the portal. Application usage duration and mean time to failure use minutes; a mean-time-to-failure value of 2147483647 means no crash events. Several startup-time columns use seconds. In the per-device score export, -1 or -2 means the associated score is unavailable, not a measured score below zero. Microsoft Learn.\nApplicability\nApply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.\nDSE recommendation\nWrite a column contract before importing the export into a spreadsheet or reporting job. Preserve the raw value, its unit, and any separate status meaning. Exclude unavailable markers from numerical summaries under an explicit rule, and represent no-crash observations distinctly from a large measured duration. Have the report owner review these choices before publishing rankings or averages.\nVerification\nTest the transformation with records representing an ordinary measured value, an unavailable score, and the documented no-crash marker. Compare each transformed value with its portal meaning and check time-unit conversions independently. Inspect the resulting summaries for implausible extremes and unintended zero substitution. Retain the report name, export period, transformation rules, and sanitized example rows so another analyst can reproduce the result without reverse-engineering an unexplained chart.\nOfficial references\nMicrosoft Learn: Troubleshooting Endpoint Analytics.",
                "datePublished": "2026-09-10T00:29:23+00:00",
                "dateModified": "2026-09-10T00:55:35+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Decode endpoint analytics export sentinels before calculating summaries"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 217,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Troubleshooting Endpoint Analytics - Microsoft Intune | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot"
                }
            }
        ]
    }
}