Endpoint Protection Small Business Edition

We are having some vulnerability scans on our network, which has triggered an alert:
"Intrusion Prevention Info; [SID: 20511] HTTP CGI Test Request detected. Traffic has been allowed from this application: C:\Windows\System32\ntoskrnl.exe"

Is there any way to block this traffic?  Or is there a good reason why it wasn't blocked?  I can't find anything in Intrusion Prevention or Firewall that seems to specifically allow this. 

Any insight would be appreciated

By default this is set to allow/log. You can change this in the IPS exceptions page.

Ahh, didn't know that you could change the behavior like that, i thought all those were to allow only.

Excellent, thank you so much!