Defender-UrlClickEvents

ActionType	Title	Sample	Rule
any	URL click activity	N	Y
ClickAllowed	Click allowed	N	N
ClickBlocked	Click blocked	N	N
ClickBlockedByTenantPolicy	Click blocked by tenant policy	N	N
UrlErrorPage	URL error page	N	N
UrlScanInProgress	URL scan in progress	N	N

any: URL click activity

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Url` (kusto rule field)	eq	`ClickedUrls`	2 rules	kusto
`Url` (kusto rule field)	is_not_null		1 rule	kusto
`IndicatorType` (kusto rule field)	eq	`url`	1 rule	kusto
`Type` (kusto rule field)	eq	`url`	1 rule	kusto

Power Apps - Multiple users access a malicious link after launching new app source high: Identifies a chain of events, where a new Power App is created, followed by mulitple users launching the app within the detection window and clicking on the same malicious URL.T1189, T1566
TI Map URL Entity to UrlClickEvents source medium: This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents.T1071
TI Map URL Entity to UrlClickEvents source medium: This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in UrlClickEvents.T1071