What causes the events?

[biskit]

In my Harmony Mobile Events screen I typically see lots of botnet/spyware events.  I'm including a very tiny example in the screenshot here.  

I'm glad this stuff is being blocked, but how do I know what is causing them in the first place?  The same events occur over and over again, so there's something on the phones causing it.  Am I looking in the wrong place, because the logs don't seem to give me any information on what's causing the events.  Is it a dodgy website?  Is it a dodgy app?  Who knows???  I certainly don't know.  The log cards don't tell me.  So I have zero idea what to try and clean up on the affected mobile phone.  

What am I doing wrong?  Or does Harmony mobile just not tell us?  Surely that isn't the case...

A similar question goes for the following Device Risk notices.  Take for example this "Network Protection (TLS) event.  What is actually causing that?  We have several users all with the same policy, so why is only one of them showing this warning?  How do I tell what it is so I know what to try and fix on that phone?

[_Val_]

Click on each to see the details.

[biskit]

The tiles in the right-hand window are not clickable so I can't see any more information on what is causing them.