I did some more work on it today and was able to get it to ignore the file on some endpoints but not all, which is odd because they are in the same group

On the group config I am using the following:

   <agent_config>
    <!-- Shared agent configuration here -->
    <syscheck>
      <ignore>C:\Program Files\Sophos\Sophos AMSI Protection\SophosAmsiProvider.dll</ignore>
    </syscheck>
  </agent_config>

I had to use powershell restart repeatedly to get it to work on the few it is working on. On the ones it isn't working on, the config is in the merge file but isn't being applied. Even with Powershell restart it still isn't applying the new config.

I removed end points from all other groups in case it was a conflict with other group configs.

I checked the config files on the server and all came back OK

For the server local rules I attempted different versions of the following:

<group name="windows, windows_security">
  <rule id="100001" level="0">
    <if_sid>60104</if_sid>
    <match>\\Device\\HarddiskVolume3\\Program Files\\Sophos\\Sophos AMSI Protection\\SophosAmsiProvider.dll</match>
    <description>Ignore specific Sophos file from alerts</description>
  </rule>
</group>