By default, Process Guard alert settings are disabled. This setting needs to be enabled to publish alerts.
Publishing of alerts can get delayed if the enrichment settings are enabled, as the Enricher Module can request acquisition of the process file for investigation. The time required to enrich the data depends on the cached information, and its integration with FireEye products.
The enrichment settings are enabled, but the Enricher Module is not properly configured.
For more information, refer to the Dependencies, Limitations and Known Issues section.