Investigating ASR Alert: Tracing the Source URL for C&C Activity

Hello everyone

I encountered an alert in Microsoft Defender indicating that a URL was blocked as a Command and Control activity. While investigating, I noticed multiple URLs accessed prior to the flagged one, including ad traffic. However, I am unable to identify the source URL that triggered this activity.

Could anyone suggest advance hunting queries or any other investigative approaches to help trace the Source URL?  I am particularly interested in methods to correlate this URL with preceding network events or processes.

Thanks