The new cPanel WebDisk facility occasionally throws up suspicious process emails when people use it. It may be worth adding its process to the ignore processes list if you let customers use it.
This is whats needed inside the process ignore list:
exe:/usr/local/cpanel/cpdavd
David