For some escalations like Defender not working properly it will not tell us in the email what device in question it is and if the device has already started working again by the time we look at it then it will disappear from the escalation page with no record. It makes it difficult to determine if there is an ongoing issue with a machine if I can't see a history of it having issues with Defender. Ideally it would just change to saying it was resolved for that host instead of removing it.