table

UrlClickEvents

UrlClickEvents contains Safe Links click events from email messages, Teams, and Office 365 apps.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproduct Microsoft Graph Security API
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi EmailUrlInfo
Related tabletable MessageUrlInfo
Related tabletable

Schema

Field	Type	Description
`Timestamp`	datetime	Date and time when the user clicked the link.
`Url`	string	Full URL clicked by the user.
`ActionType`	string	Type of click action or verdict event.
`AccountUpn`	string	User principal name of the account that clicked the URL.
`Workload`	string	Workload where the click originated.
`NetworkMessageId`	string	Unique identifier for the related email message when available.
`ThreatTypes`	string	Threat verdict associated with the URL when available.
`DetectionMethods`	string	Detection technology used to identify the threat at click time.
`IPAddress`	string	Public IP address of the device from which the user clicked the link.
`IsClickedThrough`	bool	Indicates whether the user clicked through to the original URL from the Safe Links warning page.
`UrlChain`	string	URLs present in the redirection chain, when applicable.
`ReportId`	string	Unique identifier for the click event.
`AppName`	string	Name of the client application where the click occurred.
`AppVersion`	string	Version of the client application where the click occurred.
`SourceId`	string	Unique identifier for the source of the click.
`TenantId`	string	Log Analytics workspace ID.
`Type`	string	Name of the table.
`SourceSystem`	string	Type of agent the event was collected by.
`TimeGenerated`	datetime	Date and time when the user clicked the link; identical to Timestamp.

Sample KQL

Allowed or clicked-through risky links

Find Safe Links events where users reached or clicked through to a URL with a threat verdict.

kql

UrlClickEvents
| where Timestamp > ago(7d)
| where ThreatTypes != "" or ActionType has_any ("ClickAllowed", "ClickBlocked", "ClickThrough")
| summarize Clicks=count(), Users=dcount(AccountUpn) by Url, ActionType, ThreatTypes, IsClickedThrough
| order by Clicks desc