Web control lists specific endpoint as top malware downloader but no events can be found on the endpoint itself


we can see an endpoint and user as "huge" malware downloader in "Top Malware Downladers" report: 

But I can't find a single event or alert or anything linked to specific user or endpoint. I'm using new beta Sophos Central GUI but it is the same if I switch back to old view. 

Is this report data accurate or am I missing something?

Thanks for any info where to look for the details so that I we can check if there is something strange going on and/or inform the user to stop visiting dangerous sites.

Added Tags
[edited by: Gladys at 7:39 AM (GMT -7) on 3 Oct 2023]