A method performed by one or more processors of an apparatus for determining a suspicion score for an endpoint device, the method comprising: identifying an endpoint device connected to a network; determining an endpoint-importance weight for the endpoint device based on received input parameters indicating an operating system running on the endpoint device and one or more applications running on the endpoint device by summing a hash value associated with a the- name of the operating system of the endpoint device with hash values for names of the one or more applications running on the endpoint device; identifying one or more symptom types and one or more respective symptom-importance weights for the one or more symptom types; identifying one or more events that occurred at the endpoint device at one or more respective timestamps, wherein the one or more events are associated with the one or more symptom types; calculating the suspicion score for the endpoint device based on the endpoint-importance weight and based on respective contributions of the one or more events, wherein a contribution of an event to the suspicion score is reduced based on an amount of time elapsed since a timestamp at which the event occurred, and wherein the contribution of the event is scaled based on a symptom-importance weight for a symptom type associated with the event; blocking the endpoint device from performing an action based on the suspicion score; and presenting the suspicion score on a display for a user as part of a list of suspicion scores for endpoint devices on the network, wherein the list of suspicious scores includes a number for each endpoint device indicating how many places a suspicion rank of the endpoint device has changed since the last time of updating the list. identifying an endpoint device connected to a network; determining an endpoint-importance weight for the endpoint device based on received input parameters indicating an operating system running on the endpoint device and one or more applications running on the endpoint device by summing a hash value associated with a the- name of the operating system of the endpoint device with hash values for names of the one or more applications running on the endpoint device; identifying one or more symptom types and one or more respective symptom-importance weights for the one or more symptom types; identifying one or more events that occurred at the endpoint device at one or more respective timestamps, wherein the one or more events are associated with the one or more symptom types; calculating the suspicion score for the endpoint device based on the endpoint-importance weight and based on respective contributions of the one or more events, wherein a contribution of an event to the suspicion score is reduced based on an amount of time elapsed since a timestamp at which the event occurred, and wherein the contribution of the event is scaled based on a symptom-importance weight for a symptom type associated with the event; blocking the endpoint device from performing an action based on the suspicion score; and presenting the suspicion score on a display for a user as part of a list of suspicion scores for endpoint devices on the network, wherein the list of suspicious scores includes a number for each endpoint device indicating how many places a suspicion rank of the endpoint device has changed since the last time of updating the list.