↳ GitHub sourceAnalytics ruleMedium

Egress Defend - Dangerous Link Click

View on GitHub ↗Original file ↗

Description

'Defend has detected a user has clicked a dangerous link in their mailbox.'

Rule type: Scheduled
Version: 1.1.0
Declared status: Available
Query frequency: 30m
Query period: 30m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

EgressDefend

Data types

EgressDefend_CL EgressDefend_v4_CL

KQL query

Original query, unchanged.

DefendAuditData_v4
| where LinksClicked > 0
| where ThreatLevel == "dangerous" or ThreatLevel == "suspicious"
| extend Account_0_FullName = trim(@"[^@.\w]+",Recipients)

Declared entities

AccountIPURLMailbox

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Egress Defend/Analytic Rules/DangerousLinksClicked.yaml ↗
Commit: 9800e51 ↗
Source identifier: a896123e-03a5-4a4d-a7e3-fd814846dfb2

Additional source files 2

Solutions/Egress Defend/Analytic Rules/DangerousLinksClicked.yamlsource ↗Solutions/Egress Defend/Data/Solution_EgressDefend.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.