Real Time Notification from SEP

A 20 minute damper (or more) is not very good when responding quickly to virus alerts can be the difference between a small invonvenience and a big problem.
The damper should be able to be set as low as 1 minute.

The clients still wait till their check-in time to send the log to the server, so you are already waiting for the amount of time that the client waits between checking in. (5 minutes by default) 

I agree with Jeremy that, with a little configuration, the notification timeline can get as low as the client's check-in interval.

That said, real-time notification of risks (essentially a risk detection forcing a heartbeat) is something most people would find helpful when dealing with a new threat. It could change the scenario from one where many systems have to be cleaned to one where a small handful of systems are quickly quarantined.