Hello,

We having SEP 12.1 RU1 MP 1 on our domain and SEPM Daily status report we are getting some of the incidents are still action required (Still Infected &  Suspicious & Quarantined ) what action that we have to take on these incidents  and why SEP is not able to take an appropriate action on the same ?

Still Infected - 

Check this article

http://www.symantec.com/business/support/index?page=content&id=TECH165846

Suspicious - For such files, we recommend you to submit the Suspicious files to the Symantec Security Response Team to check if the susupicious files are Threats or Good files.

Quarantined - Symantec Endpoint Protection quarantined a file.

Quarantine is a special storage area that holds objects potentially infected with viruses. Potentially infected objects are objects that are suspected of being infected by viruses or modifications of them. Objects stored in Quarantine do not represent a threat to your computer. 

Check this Article:

Explanation of Action field values in Symantec Endpoint Protection 12.1 and 11, and Symantec AntiVirus 10.1

http://www.symantec.com/docs/TECH102052

Which port SEPM uses to initiate a restart / run full scan?

Port 8014 is used to send out commands. Check this Article:

http://www.symantec.com/docs/TECH160281

Hope that helps!!