Nothing shows in the risk or threat protection logs
Symantec(tm) Endpoint Protection Version 14 (14.0 MP1) build 2349 (14.0.2349.0100
I spoke with syamntec enterprise support. They see the one risk found and also cant find anything in the logs. They beleive it might be a file that cannot be accessed. However they cannot say for sure. Prior to this we had detected supicious traffic reaching out to a yahoo IP address, with no browsers opened.
We have reimaged the PC and it appears to be resolved. We are keeping a close eye on all activity.