MDO Hunting - Teams Safe Links Click-Through

This query is designed to identify users who have clicked on potentially malicious links within Microsoft Teams over the past week. It specifically looks for events where users clicked on links that were flagged as phishing or malware threats. The query filters data from the "UrlClickEvents" table, focusing on events related to Microsoft Teams. It then projects relevant details such as the timestamp of the event, the user's account, the URL clicked, the type of threat, and whether the user clicked through a warning. The results are sorted by the most recent events. This helps in identifying potential security compromises and suggests reviewing the affected users' subsequent sign-ins and cloud activities for further investigation.