A device in active state has events that

Events waiting to be stored describes a queued or backlogged condition, not the active state where collection and storage are already successfully occurring.

The 'active' device state in RSA enVision signifies that the device is fully recognized, configured, and that its events are being continuously collected and stored through the Collector service. This is the normal, steady-state operational status for a device under active monitoring.

Events beginning to be collected from supported devices describes an initial or transitional state, not the sustained active operational state.

Events collected from a new unknown device describes the discovery process for an unrecognized source, which corresponds to a different state such as 'new' or 'unknown', not 'active'.