No data is not no incidents

The five figures at the top of Today count open cases by class, fixes waiting on you, cases past their SLA, source families observed, and build spend against the cap. A class with no observing source reads no source, never zero: security stays no source until a security source is connected and healthy, however long the queue has been empty.

The aside names every connector's health by its code. A source parked after five failures is listed as parked with its last code; its class is not counted as quiet while it is.

Every read leaves a receipt: accepted, deduplicated, rejected or lost, with the health of the source at the moment of the sighting frozen on the receipt. A day with no receipts from a source is a day the source was not read, and the source's health word says why. The capture matrix lists what each app can read at all; a family no source observes is not a family with no incidents.

Effectiveness of a prevention package is reported with its denominators: delivered to N of M targeted devices, executed in N of M eligible sessions, no matching recurrence observed during this covered window. The eligible sessions are the agent traces on the repository inside the window; they are the capture. A window with no traces, or with none after the package was installed, reads unknown with the reason, never as a quiet success. A window where the guard ran in none of the eligible sessions says delivery is not protection.

A download is a delivered receipt and nothing more. A retrieval is not a use. An interception is claimed only with a matching detection, an action and a reviewed disposition.

A case's cost is the receipts it carries. A receipt whose rate is not known is counted as unpriced and never given an amount; an estimate is shown apart from a measured amount and the two are never added. A case with no receipts has no cost recorded, which is not a cost of zero.

A session reference a source supplied is reported context until it is verified independently. A confirmed cause is a person's finding; two confirmed causes that conflict are a conflict, not a cause. A security finding with no observing source is not a clean scan.

no source

Nothing observes this class here. Connect a source.

unknown

The denominator is missing: no capture, no eligible exposure, or a source that was not read. The reason is beside the word.

unverified

A session started with no staged prevention package in context, or with a manifest that could not be confirmed current. Not protected.

parked

A source that failed five times in a row and stopped retrying until you act.

unpriced

A receipt with no known rate. Counted, never summed.

What each health word means and the fix for it is on the troubleshooting page.

The evidence panels on the six main pages, in both apps, say which of six states they are in:

Current

The panel was read inside the page's window (10 minutes for Today, 30 for the other five pages) and shows when.

Stale

It was read longer ago than that, or a device pushed it more than a day ago. The panel says how old it is. Refresh to read it again.

Measured, and nothing was found

The read worked and found nothing. This is a result.

The read failed

The store did not answer, or, on the desktop app, the read took longer than 15 seconds. Nothing in the panel is a result, and it never shows a zero.

Restricted

Your repository scope does not cover what the panel holds. Team owners and admins can see it, and so can a member whose scope includes the repository.

Not reported

Nothing measured this here: no source, no read, or no rate. It is listed under Evidence availability, never drawn as 0.