Defender for Office: How do you manage alerts?

I am trying to trigger alerts in Microsoft Defender for Office, as we want to grab the url from the alert and analyze it automatically.
I tried to send email with phishing url (was delivered), with blocked url (was quarantined) but no alert were created.
I am afraid that my approach might be wrong, so I would like to understand how do you monitor phishing email?
Are you using the Explorer or Submissions instead of Alerts?
Do you focus on inbound email, clicked URL or User Reported Phishing?