> For the complete documentation index, see [llms.txt](https://knowledge.whiteintel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledge.whiteintel.io/your-dashboard/endpoints.md). # Endpoints The Endpoints tab of the Dashboard lists infected corporate machines that carry at least one corporate credential record for the selected domain or watchlist group. It is the device-centric counterpart to the Credentials view. **Availability:** All plans for viewing. CSV export requires an organization account and, per platform policy, an Enterprise or Threat Intelligence subscription.

### Reading the table Each row represents one infected machine and shows: * the source domain (in group views), * the hostname, * the IP address, * the operating system, with a brand icon, * the country, with a flag, * the count of corporate credential records on the machine, * and the date it was last seen. A trailing action opens the endpoint detail. On mobile, machines render as cards that present the same fields stacked. ### Sorting A Sort by control orders the list by last seen or by latest added. In group views, restricted domains are skipped and reported as a count. ### Endpoint detail Selecting an endpoint opens a detail sidebar scoped to that machine, presenting: * a description of the infection, * a metadata grid for the device, and * the exposed corporate credentials, with passwords masked by default and revealable, plus remediation guidance. The detail sidebar also offers a client-side export of the metadata and the credentials currently loaded on the sidebar, for quick capture of a single machine.

### Exporting The **Export** button opens a slide-over that exports the full endpoint set server-side as a CSV file, billed against your organization's export credits. In group views you can scope the export to all domains or to a single member. See CSV exports and export credits.