Suspicious files incident on one endpoint

I have received an alert inside the ATP "Suspicious files incident on one endpoint".

What action needs to be taken on this.