Windows Filtering Platform Blocked Connection From EDR Agent Binary

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 5157,
    "Application
| endswith": [
      "\\AmSvc.exe",
      "\\cb.exe",
      "\\CETASvc.exe",
      "\\CNTAoSMgr.exe",
      "\\CrAmTray.exe",
      "\\CrsSvc.exe",
      "\\CSFalconContainer.exe",
      "\\CSFalconService.exe",
      "\\CybereasonAV.exe",
      "\\CylanceSvc.exe",
      "\\cyserver.exe",
      "\\CyveraService.exe",
      "\\CyvrFsFlt.exe",
      "\\EIConnector.exe",
      "\\elastic-agent.exe",
      "\\elastic-endpoint.exe",
      "\\EndpointBasecamp.exe",
      "\\ExecutionPreventionSvc.exe",
      "\\filebeat.exe",
      "\\fortiedr.exe",
      "\\hmpalert.exe",
      "\\hurukai.exe",
      "\\LogProcessorService.exe",
      "\\mcsagent.exe",
      "\\mcsclient.exe",
      "\\MsMpEng.exe",
      "\\MsSense.exe",
      "\\Ntrtscan.exe",
      "\\PccNTMon.exe",
      "\\QualysAgent.exe",
      "\\RepMgr.exe",
      "\\RepUtils.exe",
      "\\RepUx.exe",
      "\\RepWAV.exe",
      "\\RepWSC.exe",
      "\\sedservice.exe",
      "\\SenseCncProxy.exe",
      "\\SenseIR.exe",
      "\\SenseNdr.exe",
      "\\SenseSampleUploader.exe",
      "\\SentinelAgent.exe",
      "\\SentinelAgentWorker.exe",
      "\\SentinelBrowserNativeHost.exe",
      "\\SentinelHelperService.exe",
      "\\SentinelServiceHost.exe",
      "\\SentinelStaticEngine.exe",
      "\\SentinelStaticEngineScanner.exe",
      "\\sfc.exe",
      "\\sophos ui.exe",
      "\\sophosfilescanner.exe",
      "\\sophosfs.exe",
      "\\sophoshealth.exe",
      "\\sophosips.exe",
      "\\sophosLivequeryservice.exe",
      "\\sophosnetfilter.exe",
      "\\sophosntpservice.exe",
      "\\sophososquery.exe",
      "\\sspservice.exe",
      "\\TaniumClient.exe",
      "\\TaniumCX.exe",
      "\\TaniumDetectEngine.exe",
      "\\TMBMSRV.exe",
      "\\TmCCSF.exe",
      "\\TmListen.exe",
      "\\TmWSCSvc.exe",
      "\\Traps.exe",
      "\\winlogbeat.exe",
      "\\WSCommunicator.exe",
      "\\xagt.exe"
    ]
  },
  "condition": "security and selection"
}

False Positives

• ⚠ Unlikely