Alerts for end-of-session events are not populating. IBM explained that this is a known limitation. See TS000345587. Key paragraph of the IBM response: "the problem is due to a design limitation rather than a defect, as the Alert Service has a 10-minute limit on how stale an event can be. Counts with times older than 10 minutes are considered stale and not included their respective time periods."