Skip to content

advanced-hunting-urlclickevents-table.md

Latest commit

 

History

History
74 lines (60 loc) · 4.12 KB

advanced-hunting-urlclickevents-table.md

File metadata and controls

74 lines (60 loc) · 4.12 KB
title UrlClickEvents table in the advanced hunting schema
description Learn how to hunt for phishing campaigns and suspicious clicks using the UrlClickEvents table in the advanced hunting schema.
search.appverid met150
ms.service defender-xdr
ms.subservice adv-hunting
f1.keywords
NOCSH
ms.author pauloliveria
author poliveria
ms.localizationpriority medium
manager dansimp
audience ITPro
ms.collection
m365-security
tier3
ms.custom
cx-ti
cx-ah
appliesto
Microsoft Defender XDR
Microsoft Sentinel in the Microsoft Defender portal
ms.topic reference
ms.date 03/28/2025

UrlClickEvents

[!INCLUDE Microsoft Defender XDR rebranding]

The UrlClickEvents table in the advanced hunting schema contains information about Safe Links clicks from email messages, Microsoft Teams, and Office 365 apps in supported desktop, mobile, and web apps.

This advanced hunting table is populated by records from Microsoft Defender for Office 365. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Office 365 in Defender XDR, read Deploy supported services.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
Timestamp datetime The date and time when the user clicked on the link
Url string The full URL that was clicked on by the user
ActionType string Indicates whether the click was allowed or blocked by Safe Links or blocked due to a tenant policy, for instance, from Tenant Allow Block list
AccountUpn string User Principal Name of the account that clicked on the link
Workload string The application from which the user clicked on the link, with the values being Email, Office, and Teams
NetworkMessageId string The unique identifier for the email that contains the clicked link, generated by Microsoft 365
ThreatTypes string Verdict at the time of click, which tells whether the URL led to malware, phish or other threats
DetectionMethods string Detection technology that was used to identify the threat at the time of click
IPAddress string Public IP address of the device from which the user clicked on the link
IsClickedThrough bool Indicates whether the user was able to click through to the original URL (1) or not (0)
UrlChain string For scenarios involving redirections, it includes URLs present in the redirection chain
ReportId string The unique identifier for a click event. For clickthrough scenarios, report ID would have same value, and therefore it should be used to correlate a click event.

Note

For clicks originating from email in Drafts and Sent items folders, email metadata is either not available or NetworkMessageId is assigned by default. In this case, UrlClickEvents can't be joined with Email* tables like EmailEvents, EmailPostDeliveryEvents, and others, using NetworkMessageId.

You can try this example query that uses the UrlClickEvents table to return a list of links where a user was allowed to proceed:

// Search for malicious links where user was allowed to proceed through
UrlClickEvents
| where ActionType == "ClickAllowed" or IsClickedThrough !="0"
| where ThreatTypes has "Phish"
| summarize by ReportId, IsClickedThrough, AccountUpn, NetworkMessageId, ThreatTypes, Timestamp

Related articles