I do see all of the clients who reported the FP also did Signature/Policy/Component updates within a few minutes of the detection so my expectation is that these clients had been offline since before the update was pushed via policy and they just did...

This is still occurring Matt. We're seeing these 'Hidden User Created' detections for the Citrix 'CtxPkmService' alerts from AMP as recently as 15 minutes ago. 

Vince - I think you'll note that it's not that the email alerts aren't working - it's that the events that trigger the email alerts aren't being logged/generated and as a result of that the email alerts don't trigger.If you were getting the events lo...