# Decode endpoint analytics export sentinels before calculating summaries

> Which exported analytics values are status markers rather than ordinary measurements?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:23+00:00
- Modified: 2026-09-10T00:55:35+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 1 minutes

## What you need to know

Which exported analytics values are status markers rather than ordinary measurements?

## Potentially affected

Apply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.

## DSE recommendation

Write a column contract before importing the export into a spreadsheet or reporting job.

## Article

## Source facts

Endpoint analytics exports can encode values differently from the portal. Application usage duration and mean time to failure use minutes; a mean-time-to-failure value of 2147483647 means no crash events. Several startup-time columns use seconds. In the per-device score export, -1 or -2 means the associated score is unavailable, not a measured score below zero. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot).

## Applicability

Apply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.

## DSE recommendation

Write a column contract before importing the export into a spreadsheet or reporting job. Preserve the raw value, its unit, and any separate status meaning. Exclude unavailable markers from numerical summaries under an explicit rule, and represent no-crash observations distinctly from a large measured duration. Have the report owner review these choices before publishing rankings or averages.

## Verification

Test the transformation with records representing an ordinary measured value, an unavailable score, and the documented no-crash marker. Compare each transformed value with its portal meaning and check time-unit conversions independently. Inspect the resulting summaries for implausible extremes and unintended zero substitution. Retain the report name, export period, transformation rules, and sanitized example rows so another analyst can reproduce the result without reverse-engineering an unexplained chart.

## Official references

[Microsoft Learn: Troubleshooting Endpoint Analytics](https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot).

## Primary reference

- Name: Troubleshooting Endpoint Analytics - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/endpoint-analytics/troubleshoot
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Decode endpoint analytics export sentinels before calculating summaries,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-153-decode-endpoint-analytics-export-sentinels-before-calculating-summaries/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.