Some detectors will hold back the info trying to collect more information before deciding if it's a false positive and should be ignored or not. Also, at time there could be ingestion delays. It's hard to tell for sure without checking each individual case as well. Do you see any delays in any logical activities reported in the profile for an active entity? Can you share the workspace id ?