KQL Search

This KQL (Kusto Query Language) query is searching through the OfficeActivity data to find specific events related to Safe Links policies. Here's a breakdown of what the query does in simple terms:

1. Time Filter: It looks at records from the last 90 days (TimeGenerated > ago(90d)).

2. Operation Filter: It filters the records to only include those where the operation performed was "Set-SafeLinksPolicy" (Operation == "Set-SafeLinksPolicy").

3. Parameter Check: It further narrows down the results to those where, within the Parameters field, the 14th element (index 13) has a Name of "AllowClickThrough" and a Value of "True". This means it is looking for policy changes where the "Allow Click Through" option was enabled.

In summary, this query retrieves records of Safe Links policy changes made in the last 90 days where the "Allow Click Through" feature was turned on.