I have notification conditions setup to alert when virus definitions are out of date. We have noticed that when computers that are out of date by the set threshold, check into our SEPM console, and alert is triggered soon after. And by the time we get to the endpoint it has already updated itself to the current version.
Doesn't the alert give endpoints a time frame to collect new virus definitions after it checks in? I do have the Damper function set to 10 hours, but this just seems to be related to the time frame between alerts.
Also, the check box for "Include only clients that have checked in with the management server today" will not stay checked. I followed the steps in this KB article, TECH227916, recreated the conditions, and the SEPM is at 12.1.6 MP6, but still no luck.