Defender-UrlClickEvents

ActionType	Title	Sample	Rule
ClickAllowed	Click allowed	N	N
ClickBlocked	Click blocked	N	N
ClickBlockedByTenantPolicy	Click blocked by tenant policy	N	N
UrlErrorPage	URL error page	N	N
UrlScanInProgress	URL scan in progress	N	N

ClickAllowed: Click allowed

Table: UrlClickEvents

ClickBlocked: Click blocked

Table: UrlClickEvents

ClickBlockedByTenantPolicy: Click blocked by tenant policy

Table: UrlClickEvents

UrlErrorPage: URL error page

Table: UrlClickEvents

UrlScanInProgress: URL scan in progress

Table: UrlClickEvents

any: URL click activity

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table: UrlClickEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ThreatTypes`	1 detection rule	Kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

Power Apps - Multiple users access a malicious link after launching new app source high: Identifies a chain of events, where a new Power App is created, followed by mulitple users launching the app within the detection window and clicking on the same malicious URL.T1189, T1566
TI Map URL Entity to UrlClickEvents source medium: This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents.T1071
TI Map URL Entity to UrlClickEvents source medium: This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents.T1071