KQL Search

//Find which users clicked on a phishing link after it was detected by Defender for Office 365

//Data connector required for this query - M365 Defender - Device* tables
//Data connector required for this query - Security Alert (free table that other Defender products send alert info to)

SecurityAlert
| where ProviderName == "OATP"
| where AlertName in ("Email messages containing malicious URL removed after delivery​","Email messages containing phish URLs removed after delivery")
| extend x = todynamic(Entities)
| mv-expand x
| parse-where x with * '"Url":"' MaliciousURL '"' *
| project PhishTime=TimeGenerated, MaliciousURL
| join kind=inner (
    DeviceEvents
    | project TimeGenerated, ActionType, DeviceName, InitiatingProcessAccountName, RemoteUrl
    | where ActionType == "BrowserLaunchedToOpenUrl"
    | where RemoteUrl startswith "http")
    on $left.MaliciousURL == $right.RemoteUrl
| project-rename URLOpenTime=TimeGenerated
| extend TimeDelta = abs(URLOpenTime - PhishTime)
| project PhishTime, URLOpenTime, TimeDelta, ActionType, RemoteUrl, DeviceName, InitiatingProcessAccountName