I have notifications activated on my sepm 11 server and sometimes we got network threat protection and compliance events on some clients.
Is there any more info you can have like what webpage the user got the message from?
I only get an IP address that I can't resolve to an url...