M365 Defender Logs for URL clicks on Emails

New Contributor

Hello All,  
Hope you all are doing well
we are trying to automate a task to collect the logs of URL clicks on email as a part of phishing investigation via XSOAR but the problem is we are not sure with the schemas/table which to be used on Kusto query on "Advance hunting hunting" feature .
Any suggestions from anyone on the same? i meant how to collect the logs of URL clicks on emails?
As a part of testing we had tested below tables
1. Device Events : Which has the events of device and URL launches from devices not from the emails
2. Email Events : All the email events but not sure how to filter the URL clicked emails as there is no field to filter
3.EmailUrlInfo: All the email logs which has URL info but not sure how to filter the URL clicked logs as there is no field to filter
Kindly help us with query on the same, really appreciate! 

0 Replies
www.000webhost.com