Safe Links - Report on users to have attempted to click on a malicious link

[Antonio13286]

Hi - How can I find out who has clicked on a link that was blocked?

There was an obvious spam email doing the rounds, and I'd like to know who has fallen for it?

Thanks

[#2]

Hi!

Here:

https://docs.microsoft.com/en-us/office365/securitycompliance/view-reports-for-atp

Adam

[#3]

Hi @Antonio13286,

You can use Get-UrlTrace

https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/get-urltrace?...

As described in the article, this is designed to determine who clicked through to a malicious web site in the past 7 days. To note, it’s currently limited to 7 days

Hope that answers your question!

Best, Chris

[#4]

Thanks Adam. I’ve had a look through the dashboards, but can’t find any reports that specifically list the users?

[#5]

Thanks Chris, I’ve run that command, but still not getting the results. There’s some users whom I know got the blocking page, but they didn’t show up?

[#6]

Be aware that this command only goes 7 days back!

[#7]

That’s right!

And if you have specific users you think clicked through have you tried the full command as shown in the example for particular users -

Get-UrlTrace -RecipientAddress "michelle@contoso.com" -StartDate "5/9/2016" -EndDate "5/11/2016"

Best, Chris