Blog Post

Microsoft Defender for Office 365 Blog
3 MIN READ

Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365

VipulPandey's avatar
VipulPandey
Icon for Microsoft rankMicrosoft
Apr 27, 2022
We are excited to announce the public preview for a new data source in Microsoft 365 Defender advanced hunting—the UrlClickEvents table from Microsoft Defender for Office 365, with the changes starti...
Updated Apr 27, 2022
Version 2.0
bec
Hunting
microsoft 365 defender
phishing
MarcinGorski's avatar
MarcinGorski
Copper Contributor
Jul 24, 2024

stromnessian In the situation you described

| where ActionType == "ClickAllowed" and IsClickedThrough == "0"

it means that the user was not prevented and clicked the URL.