URL click count by click action

Description

This query helps reviewing URL click count by ClickAction

Query · kql

UrlClickEvents 
| extend UrlBlocked = ActionType has_any("ClickBlocked") 
| extend UrlAllowed = ActionType has_any('ClickAllowed') 
| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress') 
| extend ErrorPage = ActionType has_any('UrlErrorPage') 
| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough)
Raw source URL click count by click action · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 3f007cdc-86bf-4657-9015-05101a3e54f5
name: URL click count by click action
description: |
  This query helps reviewing URL click count by ClickAction
description-detailed: |
  This query helps reviewing URL click count by ClickAction using Defender for Office 365 data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents 
  | extend UrlBlocked = ActionType has_any("ClickBlocked") 
  | extend UrlAllowed = ActionType has_any('ClickAllowed') 
  | extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress') 
  | extend ErrorPage = ActionType has_any('UrlErrorPage') 
  | summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough)
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.