In the off chance anyone here is able to answer ... does anyone know how to trace the originating app when Little Snitch detects an outgoing connection from net

In the off chance anyone here is able to answer ... does anyone know how to trace the originating app when Little Snitch detects an outgoing connection from netbiosd? I believe that happens when an app tries to access an smb mount. Some app on my computer is constantly doing that to an AWS-hosted mount, but I can't figure out what.