Endpoint Detection and Response (EDR) appliance sends 4098 and 4117 events to ICDx as 14: Detected instead of 0: Unknown
This issue is resolved starting with Endpoint Detection and Response (EDR) 4.6.0.
Please upgrade to change the behavior.