Hi, Austin. Thanks for the question. This is actually a really timely coincidence, since today we happen to have several tech experts monitoring this very board for AMP questions. So the fact that we happen to have a couple of high-profile false positive incidents coming up today -- rare, but does happen from time to time -- actually gives me a great opportunity to explain how AMP works in situations like this.
Specifically for situations like this, there is the "whitelist" feature. Any time you find something that AMP classifies as a threat, but that you know to be benign, you can immediately resolve it via Application Control > Whitelists. Create a whitelist and add the SHA-256 of the file in question, and your AMP deployment will not convict the file.
Cisco works very hard to avoid falsely convicting files, but like I said, accidents and mis-classifications will happen occasionally. Our product has been built with this reality in mind. Our Talos team should have the underlying issue corrected soon, but you have complete control yourself in the meanwhile.
