FortiClient Firewall Events

I have been seeing some sporadic Gh0st.Rat.Botnet and Bladabindi.Botnet notices in FortiClient EMS for a particular system. Is there a way to find out if this is incoming or outgoing? If it is incoming I am not that concerned. If it is outgoing I would be concerned about an infection on that particular machine.