Contract Management notification 'Contract Threshold breached' shows it is using the event antivirus.infected

When looking at the notification 'Contract Threshold breached' it shows it is using the event antivirus.infected but in reality it is using the event contract.expiration

The event contract.expiration doesn't exist in the event registry. This event is coming from the plugin 'Software Asset Management Extensions' com.snc.sam which is installed out of the box for new instances but is missing in instances that are converted from Express.

Request installation of the plugin 'Software Asset Management Extensions' com.snc.sam through HI. The plugin needs to be requested because it can't be installed by an admin.