Symantec Endpoint protection intrusion report

Make sure I understand this report before I report back to our client.

They run a daily report that shows 1 critical top target attacked by client.

It appears to show a external public IP as the system?

If so since the rest of the report says they are ok and if I am right how is the best way to explain this to them?

Or is there something they should do about that system that appears to be tring to get in?

Thanks

Mike

See picture.