Teams URL clicks through actions on Phish or Malware URLs summarized by URLs

id: 8ccb7460-16a4-4cff-9ce7-0eaea2c3d480
name: Teams URL clicks through actions on Phish or Malware URLs summarized by URLs
description: |
  This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls.
description-detailed: |
  This query visualizes clicks through actions on Phish or Malware URLs in Teams, summarizing the data by Urls.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Teams URL clicks through actions on Phish or Malware URLs summarized by URLs
  UrlClickEvents 
  | where IsClickedThrough !="0" and Workload =="Teams"
  | where ThreatTypes in ("Phish","Malware") 
  | summarize by Url,ThreatTypes, IsClickedThrough, ActionType
version: 1.0.0