SEPM: Malware with allowed by user action

Hey guys,

I cant figure out why we are having  Allowed by user action in our risk logs. I thoroughly check the AV Policy for this option and I cant find it. I also check the exception policy and the detected file was not there. Am I missing something here?

Thank you,