Currently when you view an endpoint in our platform, the first 10 signals are visible. Often they are more than 10 recent signals firing on a compromised host and analysts must manually expand the "entries" dropdown to 25, 50, etc. I'd recommend expanding this by default to show 25/50 or at least all signals for the past 7 days.