Teams blocked URL clicks daily trend

Description

This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages.

Query · kql

//This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages summarizing the data by various Teams app names.
let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
UrlClickEvents
| where Timestamp >= TimeStart
| where ActionType == "ClickBlocked" and Workload =="Teams"
| make-series TeamsBlockedClicks = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by AppName
| render timechart
Raw source Teams blocked URL clicks daily trend · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6d740b56-08b9-441c-ba12-32621225408d
name: Teams blocked URL clicks daily trend
description: |
  This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages.
description-detailed: |
  This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages summarizing the data by various Teams app names.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query visualizes the daily amount of blocked Url clicks performed by users on Urls in Teams messages summarizing the data by various Teams app names.
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  UrlClickEvents
  | where Timestamp >= TimeStart
  | where ActionType == "ClickBlocked" and Workload =="Teams"
  | make-series TeamsBlockedClicks = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d by AppName
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.