@Lloyd Adams - This process or sensor is part of onboarding via technologies such as Microsoft Security Center, Windows Defender and ATP. There are also third party integrations via Dell as well as a few others noted in the links below (SCOM or onboard to Log Analytics workspace, etc). You may notice the workflows run in a temporary file in that directory. The process runs under the workflow servicing context named MonitoringHost.exe as the Health Service runs in conjunction.
Microsoft Windows Security Center - Warning
Reference: Docs - Warning on bottom of page
"Warning - You should not attempt to disable, stop, or modify any of the associated services used by Windows Defender AV, Windows Defender ATP, or the Windows Security app.
This includes the wscsvc, SecurityHealthService, MsSense, Sense, WinDefend, or MsMpEng services and process. Manually modifying these services can cause severe instability on your endpoints and open your network to infections and attacks.
It can also cause problems when using third-party antivirus apps and how their information is displayed in the Windows Security app."
Dell - notice the av exclusions and other integration points\services
https://www.dell.com/support/article/lt/en/ltbsdt1/sln304640/how-to-unregister-register-dell-endpoin...
