A new installation, everything is up to date.
When I go to the defender page, about 10-20 seconds after viewing the notifications, a message is popped up:
The only other thing that doesn't ever complete is the audit logging update.
What causes this?
NOTE: We run our firewalls "tight". We don't allow traffic out to the web unless we know the address, so if we need to allow access to some service on your side, please specify which addresses and ports we should allow. In our firewall logs we don't notice any attempts that are blocked however.