Microsoft Teams URL Click Events
This rule identifies instances where users have clicked on URLs within Microsoft Teams. It specifically filters for 'UrlClickEvents' where the 'Workload' is 'Teams' and provides details such as the timestamp, user principal name, URL, URL domain, action type, and network message ID. This can be used to investigate potential phishing attempts or malicious link clicks within the Teams environment.
Microsoft Sentinel (KQL)
