DEX Anomalies and events

DEX anomaly refers to the unexpected or unusual behavior or performance issues happening on the user endpoints that deviate from normal patterns. These anomalies are typically identified using metrics and behavioral baselines collected by the BigFix Scanner (like response times, resource usage, disk performance, app crashes, etc.) and computed by the Scanner DEX plugin.

All anomalies except for Boot, Logon, and Reliability are evaluated on the ATI of 5 minutes. See also, DEX Device Performance Metrics. Boot, Logon, and Reliability are connected to behavioral events, for instance device boot, user logon or a system crash so they are immediately evaluated as possible sources of anomalies.

The reason behind the same is, if the average of any scorable metric in the ATI exceeds the moderate threshold for that metric, an anomaly is raised. Every metric has a moderate and severe threshold associated with it; both of them are hardcoded in this release but will be configurable in next releases. Those thresholds are visible for each scorable metric in the metric trend over time for each device. The longer the average of the metric exceeds the thresholds, the more anomalies are produced.

DEX anomalies are critical for the IT teams because they:

  • help detect end-user issues in a timely fashion and remediate them proactively
  • enable automated remediation or manual intervention before users report problems
  • support root cause analysis and long-term trend monitoring

In terms of BigFix DEX, the anomalies are important because any time they are detected on a device, the DEX score for that device decreases, allowing the IT administrator to get visibility of something going wrong on the managed devices.

For metrics related to durations (Boot/Logon) the anomaly has a weight representing how much the duration exceeds the threshold. The higher the weight, the more the anomaly decreases the score.

Example in BigFix DEX:

If the DEX BigFix Scanner DEX Plugin detects that a disk partition’s free space of the end user device (calculated as average in a 5 min interval) drops below 10%, it flags the condition as an anomaly, having the Partition score of that endpoint decrease.

DEX Events

DEX endpoints transmit events towards back-end servers reporting real-time events information (e.g. type, timestamp) and if needed the associated score penalty to update the live scores.