What are the differences between "File Share Event - External" and "File Share Event External File Share Risk"?

The "File Share Event - External" alert without email means someone has pressed the share button from within the document and sent to the user directly. External again indicating the file was shared with an email address to an outside domain or organization.

Additionally, we have the "File Share Event - External File Share Risk" alert, which is generated when a file has been shared outside the organization via SharePoint/OneDrive/Teams with an anonymous link and no expiration. And the "Email File Share Event - External File Share Risk" alert is triggered when a  SharePoint/OneDrive file with an anonymous link and with no expiration was shared via Outlook/email as an attachment.

Pro tip: If a file has been shared externally with an anonymous link, SaaS Alerts will check after 30 days of the creation of the link and if the link is still active a new "File Share Event - External File Share Risk" or "Email File Share Event - External File Share Risk" alert will be generated.