Riskware-callback alerts indicate that the endpoint is sending confirmed callback traffic to a command-and-control server. This alert occurs if a riskware object was downloaded and launched on an endpoint.
The endpoint should be investigated immediately and removed from the network during the process. Check local security logs and SIEM logs. You can also use the Endpoint Security (HX) server for triage investigation.