Safe Link UrlClick events ?

Question

hi,

can't set the tag to Defender for Endpoint or Defender 365 !

Question. Having trouble to understand telemetry from Safe Links clicks from e-mail messages.

Looking at https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-urlclickevents-table?view=o365-worldwide

The click was allowed as per the above screen shot Action type = Click allowed . What does the even mean? It was not blocked by Safe Link ?

If it was not blocked what’s then the relevance of Is clicked through = false ?

This DOES not make any sense to me ! I don't see the url as rewriten. The click was allowed so what click trough to what original URL ? ?

Answer 1

Maybe this link will help. This is more of a Defender for Office topic but it sounds like pass through may be allowed in some situations depending on the policy settings. This may be more of an audit if not blocked.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide#safe-links-settings-for-email-messages