Defender for Business - No alert after process lock out ?

Are you sure you are getting emails on all alerts and incidents? Configuring these email notifications you need to choose the sources and the severity. In my train of thought it easy to just select high and medium severity for emails to reduce the noise. However, Defender often puts the informational or low severity on an alert when it has blocked the threat and e.g. it is not a well known hacking tool.