User clicked through events

id: f075d4c4-cf76-4e5d-9c2d-9ed524286316
name: User clicked through events
description: |
  This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page.
description-detailed: |
  This query helps reviewing malicious clicks where user was allowed to proceed through malicious URL page via click though option on SafeLinks warning page in Defender for Office 365.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  UrlClickEvents 
  | where ActionType == "ClickAllowed" or IsClickedThrough !="0" 
  | where ThreatTypes has "Phish" 
  | summarize by ReportId, IsClickedThrough, AccountUpn, NetworkMessageId, ThreatTypes
version: 1.0.0