LSASS performing registry modifications (modifiying system certificates) triggers SAMR alert

Joe Stern , The info provided does not show any correlation between the alerts and the actions described happening by defender, unless  you can tell me that defender created these queries/network traffic. Accessing the registry or modifying certs is not related to this alert...