CYFOX identifies a threat whenever customers click on "Check for updates" in Windows Defender
Proposed Solution:
Rewrite the alert to “The defender has been updated” or something similar.