Nov 23 2020 12:13 PM
Nov 24 2020 01:26 PM - edited Nov 24 2020 01:32 PM
@burnettcmultiply hours is not fine. I see alerts mostly popping up after 2 minutes of delay. Maybe this was caused by delays from your proxy to the backends? Check this here, to see what connections endpoints make. There is also a sheet with all IPs and connections which Defender does. Make sure, there was no bottleneck during deployment phase to these IPs/DNS/URLs. If you open the sheet, go to the left side to see all URLs. Maybe these devices had problems communicating with backend.
Nov 24 2020 10:24 PM