When reviewing the License Usage table and graph, the number of endpoints is different than what is shown in the CSV file.
Red Canary Licenses
The graphs and tables for the licensing utilization represent the max active endpoints in the last 24 hours of data. This information is updated daily. In contrast, the CSV file will provide the last 30 days of data showing all the endpoints that have connected to the server during those 30 days.
For example, you may see 100 total endpoints for the month of December, but when you view this data in the CSV file, it shows 200 endpoints. The CSV file shows any and all endpoints that have communicated with Red Canary over the last 30 days while the table will only show the maximum number of active endpoints in the last day.
This is by design and the difference between the values is expected. Use total endpoints from the table to get the most accurate number of endpoints and licenses being used.