URLClick details based on malicious URL click alert

id: 03e61096-20d0-46eb-b8e0-a507dd00a19f
name: URLClick details based on malicious URL click alert
description: |
  In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected
description-detailed: |
  In this query, we are looking for Url clicks on emails which are generated the alert-A potentially malicious URL click was detected in Defender for Office 365.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
   - UrlClickEvents
   - Alertinfo
   - AlertEvidence
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  AlertInfo
  | where Title contains "Potentially malicious" and Timestamp > ago (30d)
  | join kind=inner (AlertEvidence| where EntityType == "MailMessage") on AlertId 
  | join UrlClickEvents on NetworkMessageId
version: 1.0.0