SafeLinks URL detections

Description

This query provides insights on the detections done by SafeLinks protection in Defender for Office 365

Query · kql

EmailEvents 
| where DetectionMethods != "" 
| extend detection= tostring(parse_json(DetectionMethods).Phish) 
| where detection == '["URL detonation reputation"]' or detection == '["URL detonation"]' 
| summarize total=count() by bin(Timestamp, 1d) 
| order by Timestamp asc
Raw source SafeLinks URL detections · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 492f1ea1-37c3-410a-a2f2-4e4eae2ff7f9
name: SafeLinks URL detections
description: |
  This query provides insights on the detections done by SafeLinks protection in Defender for Office 365
description-detailed: |
  This query provides insights on the detections done by SafeLinks protection in Defender for Office 365
  Reference - https://learn.microsoft.com/en-us/defender-office-365/safe-links-about
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where DetectionMethods != "" 
  | extend detection= tostring(parse_json(DetectionMethods).Phish) 
  | where detection == '["URL detonation reputation"]' or detection == '["URL detonation"]' 
  | summarize total=count() by bin(Timestamp, 1d) 
  | order by Timestamp asc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.