CloudSOC has the option to send files for further analysis to a sandbox, this feature is known as "Dynamic Analysis" can can be found, under "Settings -> Threat Protection"
Please note the feature is only available if the customer has purchased the correct license
you suspect Dynamic Analysis is returning a false positive
False positives can be submitted at: https://symsubmit.symantec.com , on the tab "Incorrectly detected by Symantec"