Blocked URL Clicks by Workload

id: 41831d30-f03e-44a9-bd27-f713033393b7
name: Blocked URL Clicks by Workload
description: |
  This query visualises blocked Safe Links URL clicks over time broken down by the workload the click came from (Email, Teams, Office, Microsoft 365 Copilot).
description-detailed: |
  This query visualises Safe Links URL clicks that were blocked (ActionType == "ClickBlocked") over time in Microsoft Defender for Office 365, broken down by the workload the click originated from (Email, Teams, Office, Microsoft 365 Copilot), to show where users most often attempt to reach malicious URLs.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  UrlClickEvents
  | where Timestamp >= TimeStart
  | where ActionType == "ClickBlocked"
  | make-series Teams = countif(Workload == "Teams"), Office = countif(Workload == "Office"), Email = countif(Workload == "Email"), Copilot = countif(Workload == "Copilot") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0