URL Clicks by Action

Description

Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness. Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303

Query · kql

UrlClickEvents
| summarize Count = count() by ActionType
| render piechart
Raw source URL Clicks by Action · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4620ece3-dceb-4151-8621-5a56351c97cd
name: URL Clicks by Action
description: |
  Summarizes URL click events by action type to help analysts understand user click behavior and policy effectiveness.
  Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents
  | summarize Count = count() by ActionType
  | render piechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.