seems like in July 2018 we stopped receiving and see alerts for missing services on devices.
I do understand that's because there was a lot of false positive alerts but when services are not running that's mean the machine isn't protected for a specific threat.
I think that we should have a notification center that we will be able to control what notification we would like to get will be amazing and will solve both problems for users that getting false positive and also will serve the users that would like to know when a service isn't running.
the other way is to have a buffer time before the alerts show up on missing services this way will reduce the amount of false positive but the admins can still manage the machine and have everything under control and fully protected