Query Details

TI Open Phish Free Feed Hits In Email Url Info

Query

//OpenPhish Free Feed Hits in EmailUrlInfo
let OpenPhish = externaldata(Url: string)["https://openphish.com/feed.txt"];
EmailUrlInfo
| where UrlDomain has_any(OpenPhish)
| join EmailEvents on NetworkMessageId

Explanation

This query looks for any URLs in email messages that match the OpenPhish list of known phishing websites. It then joins this information with email events data.