URL Click attempts by threat type

id: 3eef362d-3aee-4950-9208-4afa6f7afbe9
name: URL Click attempts by threat type
description: |
  Visualises the total amount of click attempts on URLs with detections, split by the different threat types identified.
  Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  UrlClickEvents
  | where Timestamp >= TimeStart
  | where isnotempty(ThreatTypes)
  | summarize Count = count() by ThreatTypes, bin(Timestamp, 1d)
  | render timechart
version: 1.0.0