o365 Security Threat Report

Hi community! I'm currently looking at a Security Threat Report in the o365 admin center.

 I'm just wondering how a mail qualifies to be listed under the "Users Targeted by Malware Campaigns". 

The active policy is the default policy that comes with the initial o365 installation. Of course I can create a new policy, but how effective is that if I do not know why the previous mails were selected by the o365 Exchange Security?

Any recommendations?