I agree. The active threat counts and list in ERA is very strange behavior. Not as expected.
Also the active threat in computer detail view does not seem to correspond with the quarantined view. Things that have been quarantined also show up as an active threat. It's all pretty confusing when it could be so straight forward.
It's really, really difficult to determine what is a actual active threat and what has been taken care of. These lists and statuses need to be very clear and straight forward when dealing with 100's of remote computers.
Also, it's very difficult to tell if a computer needs a reboot to finish cleaning or not.