Endpoint Protection

Hello, I've recently setup notifications for email with our SEP server. The notifications that come in are usually not helpful and contain messages such as...

"Found 1 or more security events. Actual number of security events found was 74 in 1 minutes.
Security events included:
Compliance, Device Control, Network Threat Protection, Traffic, Packet and Application Control."

But when I look further in the email, it's a lot of pie charts with 'No data'

And sometimes it will come in with data, but I would say 80% of the time it's 'No data'.

Did I configure something incorrectly in notifications?

This looks to be from risks detected, not NTP, which would show targets attacked. What alert/report was configured?

I have the alert set as:

If you check Monitors >> Logs >> Network Threat Protection, do you have any relevant data there?

Yes, we run a vulnerability scanner and it has multiple entries in that log file which is expected.
 

But the last time it ran was 02:58:32, that screenshot with the 'no data' sent out at 4:34am, 5:34am, 6:34am and 7:34am

Any further assistance would be greatly appreciated

What is the exact SEPM version?

Try deleting and re-creating the alert.

I'm on 12.1.6 (12.1 RU6 MP4) build 6860 (12.1.6860.6400)

I've re-added the alert. I'll let you know how it goes.

Thanks again for your help.

Sounds good.

I've changed it to a event list vs a summary report and it appears to be good so far, althought it's just doing application control events so far