Feedback Edit

UrlClickEvents

  • Article
  • 2 minutes to read

Note

Want to experience Microsoft 365 Defender? Learn more about how you can evaluate and pilot Microsoft 365 Defender.

Applies to:

  • Microsoft 365 Defender
  • Microsoft Defender for Office 365

The UrlClickEvents table in the advanced hunting schema contains information about Safe Links clicks from email messages, Microsoft Teams, and Office 365 apps in supported desktop, mobile, and web apps.

Important

Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
Timestamp datetime The date and time when the user clicked on the link
Url string The full URL that was clicked on by the user
ActionType string Indicates whether the click was allowed or blocked by Safe Links or blocked due to a tenant policy e.g., from Tenant Allow Block list
AccountUpn string User Principal Name of the account that clicked on the link
Workload string The application from which the user clicked on the link, with the values being Email, Office and Teams
NetworkMessageId string The unique identifier for the email that contains the clicked link, generated by Microsoft 365
IPAddress string Public IP address of the device from which the user clicked on the link
ThreatTypes string Verdict at the time of click, which tells whether the URL led to malware, phish or other threats
DetectionMethods string Detection technology which was used to identify the threat at the time of click
IsClickedThrough bool Indicates whether the user was able to click through to the original URL or was not allowed
UrlChain string For scenarios involving redirections, it includes URLs present in the redirection chain
ReportId string This is the unique identifier for a click event. Note that for clickthrough scenarios, report ID would have same value, and therefore it should be used to correlate a click event.

You can try this example query that uses the UrlClickEvents table to return a list of links where a user was allowed to proceed:

// Search for malicious links where user was allowed to proceed through
UrlClickEvents
| where ActionType == "ClickAllowed" or IsClickedThrough !="0"
| where ThreatTypes has "Phish"
| summarize by ReportId, IsClickedThrough, AccountUpn, NetworkMessageId, ThreatTypes, Timestamp