Has anyone else noticed that if say Def for Endpoints shows Outlook opening a suspicious email (ie it contains a known malicious URL), if you carry on an investigation using mail explorer it cannot find the URL. Indeed if you find the actual email that MDE shows Outlook opening then the UI displays "no URLs found". This certainly used to work and I'm assuming a problem with data ingestion. Have noticed (not sure if this is new) that there is now an EmailURLInfo table. But have searched all the tables in M365D and not found reference other than within MDE.
The goal is to search through other emails containing the same URL to see who was part of the phishing campaign - NOT who has clicked the link!
Thanks for any thoughts,
Paul.
