When DMARC reports are hard to understand, which columns should I start with for email spoofing troubleshooting?

After our company domain implemented DMARC, our security mailbox started receiving a pile of XML reports every day, which no one looked at initially. Later, when a colleague in Finance received a spoofed email, we realized that some third-party systems were sending emails without passing SPF, and there were already signs of this in the reports. My approach is to first import the RUA reports into…