Microsoft Defender for Endpoint’s Advanced Hunting feature enables in-depth analysis of security incidents within organizations. One of the most frequently used tables in this context is the UrlClickEvents table. This table records in detail the URLs that users click on via email, Teams, or other Microsoft 365 components.
The following query example is used to analyze clicks made on a specific domain
UrlClickEvents
| where Url contains "msftadvocate.com"
