Teams URL clicks actions summarized by URLs clicked on

Description

This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them.

Query · kql

//Teams URL clicks actions summarized by URLs clicked on
UrlClickEvents
| extend UrlBlocked = ActionType has_any("ClickBlocked")
| extend UrlAllowed = ActionType has_any('ClickAllowed')
| extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')
| extend ErrorPage = ActionType has_any('UrlErrorPage')
| where Workload == "Teams"
| summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url
Raw source Teams URL clicks actions summarized by URLs clicked on · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f2031075-0834-4c87-81fe-1e369ffbc277
name: Teams URL clicks actions summarized by URLs clicked on
description: |
  This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them.
description-detailed: |
  This query visualizes user clicks in Teams summarizing the data by the various URLs and Click actions on them.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Teams URL clicks actions summarized by URLs clicked on
  UrlClickEvents
  | extend UrlBlocked = ActionType has_any("ClickBlocked")
  | extend UrlAllowed = ActionType has_any('ClickAllowed')
  | extend UrlPendingVerdict = ActionType has_any('UrlScanInProgress')
  | extend ErrorPage = ActionType has_any('UrlErrorPage')
  | where Workload == "Teams"
  | summarize Blocked = countif(UrlBlocked), Allowed = countif(UrlAllowed), PendingVerdict = countif(UrlPendingVerdict), Error = countif(ErrorPage), ClickedThrough = countif(IsClickedThrough) by Url
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.