Safe Links - Report on users to have attempted to click on a malicious link

New Contributor

Hi - How can I find out who has clicked on a link that was blocked?

 

There was an obvious spam email doing the rounds, and I'd like to know who has fallen for it?

 

Thanks

 

6 Replies
Hi @Antonio13286,

You can use Get-UrlTrace

https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/get-urltrace?...

As described in the article, this is designed to determine who clicked through to a malicious web site in the past 7 days. To note, it’s currently limited to 7 days

Hope that answers your question!

Best, Chris
Thanks Adam. I’ve had a look through the dashboards, but can’t find any reports that specifically list the users?
Thanks Chris, I’ve run that command, but still not getting the results. There’s some users whom I know got the blocking page, but they didn’t show up?
Be aware that this command only goes 7 days back!
That’s right!

And if you have specific users you think clicked through have you tried the full command as shown in the example for particular users -

Get-UrlTrace -RecipientAddress "michelle@contoso.com" -StartDate "5/9/2016" -EndDate "5/11/2016"

Best, Chris