Action to Still Infected & Suspicious

Hi All

Good Day...

We having SEP 12.1 RU1 MP 1 on our domain and SEPM Daily status report we are getting some of the incidents are still action required (Still Infected &  Suspicious & Quarantined ) what action that we have to take on these incidents  and why SEP is not able to take an appropriate action on the same ?

Which port SEPM uses to initiate a restart / run full scan?

Regards

Ajin