Verify that the reported host runs a legitimate application on the port.
For example, port 8080tcp is the default alternative port for HTTP. It is used by many legitimate applications.
Look up what the destination host is supposed to be running in your configuration management database (you do have a CMDB, do you?). When it is supposed to run, for example, an Apache Tomcat application server (which uses port 8080), this is intended behavior and harmless. Verify that the Tomcat server is actually working. When it does, it means that the port is in use and can not be used by any malware without having to kill the Tomcat process, and that would cause whoever needs it to complain. Add a filter rule to your reporting system to prevent further reports about that server and port 8080 to show up. Such filter rules are important because any false-positives which show up in your reports just distract from any actual positives. You might also want to add a rule to your reporting system which generates an alert when that ip:port combination does not show up anymore. It would either mean that the server is down or that it was repurposed to no longer run that application and you need to update your filter rules and your CMDB.
However, When you find that port open on a host which isn't supposed to run anything which might use 8080, that's worth investigating. Log into the server, run
netstat and check what application opened that port. Then use your own judgment to decide if it is legitimate or not.