Is it common for a program to move from 'Allow' to 'Monitor'? If so, what could cause this?
Best answer by StevenK
Google Chrome has been known to cause this kind of behaviour in the past.
It's due to Chrome's silent and frequent updates which meands tha the MD5 for Chrome and it's associated processes (such as the updater) change on a regular basis.
Sometimes this can appear as suspicious to WSA.
If you would like to submit a support ticket with this information then we can add rules to our cloud database that should resolve this issue for you.