SEP Network protection blocks file server

SEP with network protection will block internal file server multiple times during the day. We have disabled feature as a temp solution. I looked at logs but don't see what rule triggered the block.