When viewing the Device Malware Status dashlet, status categories include Resolved, Unresolved, No Threats, and Unknown.
The Unknown status is determined by the setting configured here. Unknown is defined as devices that have not contacted the server for x number of days. The default setting is 3 days, but you can modify the value based on your requirements. This setting is defined as the “Unknown Threshold”.
The recommended value is in the range of 3-7 days. If you set the value too low, the frequency of the Unknown status in the security dashlets may get cumbersome. If you set the value too high, you may make a false assessment of device protection based on the status in the dashlets.
To change the threshold value, navigate to Configuration > Management Zone Settings > Security > Security Dashboard, and modify the value in the Device Malware Status Unknown Threshold section.