Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)

id: 7d7a3d3f-22db-4cdf-ba67-c57215777a3c
name: Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)
description: |
  Visualises the top 10 users with click attempts on URLs in emails detected as malware, phishing, or spam, helping analysts identify risky user behaviour and potential targets.
  Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents
  | where ThreatTypes has_any ("Malware", "Phish", "Spam")
  | summarize count() by AccountUpn
  | top 10 by count_
  | render piechart
version: 1.0.0