Liam;
That is certainly indicative of a summarized signature event. If you look further into the raw message, you should see indication that this is a summary event, as well as the initial trigger event ID. You may be able to determine a single source from the initial event - but in most instances, these events are generated due to behavior of the attacker, and you would want to investigate the attacker/source of the event if it is located within your control. If you really want to investigate each, and every occurrence of the attack, you could disable summarization on the signature in question (set the Summary Mode to 'Fire All'). This has the potential to generate a large number of events, and should not be used long-term. For the specific TCP Hijack signature, there are benign triggers explained on our IntelliShield site:
http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=3250&signatureSubId=0&softwareVersion=6.0&releaseVersion=S394
It is always good to be concerned over any incident that is reported prior to any investigation by yourself to understand the implications. Upon determination of the underlying cause of the signature event, you may wish to continue getting alerts on the event, or you could create an event action filter on the IPS to stop alerting for specific IP addresses, or create a drop rule in the CS-MARS to only log the event to the database (or drop completely).
Scott
