URL clicks actions by URL

Description

In this query, we are looking URL click actions by URL in the last 7 days

Query · kql

UrlClickEvents
| extend UrlBlocked = ActionType has_any("ClickBlocked")
| extend UrlAllowed = ActionType has_any('ClickAllowed')
| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')
| extend ErrorPage = ActionType has_any('UrlErrorPage')
| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url
Raw source URL clicks actions by URL · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: bc46e331-3cb0-483d-9c90-989d2a59457f
name: URL clicks actions by URL
description: |
  In this query, we are looking URL click actions by URL in the last 7 days
description-detailed: |
  In this query, we are looking URL click actions by URL in the last 7 days using Defender for Office 365 data.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
   - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents
  | extend UrlBlocked = ActionType has_any("ClickBlocked")
  | extend UrlAllowed = ActionType has_any('ClickAllowed')
  | extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')
  | extend ErrorPage = ActionType has_any('UrlErrorPage')
  | summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.