HI,

Check this thread

https://www-secure.symantec.com/connect/forums/sep-blocking-traffic-ntoskrnl

https://www-secure.symantec.com/connect/forums/symantec-endpoint-protection-110420275-blocked-traffic-ntoskrnlexehelp

https://www-secure.symantec.com/connect/forums/nt-kernel-amp-system-ntoskrnlexe-blocking-message-repeatedly-appearing

Hello,

Looks like a Network Application Monitoring message.

Check if - 

Clients > Policies > Location-independant Policies and Settings: Network Application Monitoring > Enable network application monitoring

is turned on.

If yes, turn it off or change "When an application change is detected" to "Allow and log".

But you should only do that if you are sure that the alert was really a false positive.

OR

In SEPM goto "Clients" and click on any of your groups. Then open the "Policies" tab. Click on the third option "Network Application Monitoring". You can switch it off or add an execption for NTOSKRNL.EXE.

Check these Threads, if these helps:

https://www-secure.symantec.com/connect/forums/nt-kernel-amp-system-ntoskrnlexe-blocking-message-repeatedly-appearing

https://www-secure.symantec.com/connect/forums/network-threat-protection-ntoskrnlexe-new

https://www-secure.symantec.com/connect/forums/network-threat-protection-9

Hope that helps!!

Setting up network application monitoring

http://www.symantec.com/business/support/index?page=content&id=HOWTO27062