Open Phish Urls In Emails
Query
let OpenPhish = externaldata (Url: string) ["https://openphish.com/feed.txt"];
EmailUrlInfo
| where Url has_any (OpenPhish)
| join EmailEvents on NetworkMessageIdExplanation
This query looks for email events that contain URLs listed in the OpenPhish feed.