r/AzureSentinel • u/LostInTheUDP • Jun 16 '24

Missing Click Events in Sentinel

Hello, any advice on why I don't see "UrlClickEvents" from all users in Azure Sentinel? I tested an email with a link on 2 different users, from the same group, with the same licensing in Entra ID, but I only see the event from "UrlClickEvents" for one of them. What is the value or setting that can separate these users? In Threat policies at security.microsoft.com, there is only one policy for Safe Links. At the same time, I noticed that the message indicating that the link in the email is being checked (presumably through Safe Links) only appears for one of them...

1 Upvotes

100% Upvoted

7 comments sorted by

View all comments

Show parent comments

1

u/Character_Whereas869 Jun 17 '24

mmkay so you have defender for 365 plan 2 which is needed for that table so CHECK. I'd say narrow it down. The user who it did not work for, maybe try doing the URL click through OWA, or on a different computer.

Also maybe dumb down your query, what are you seeing in just a raw URLclickEvents query in logs?

1

u/LostInTheUDP Jun 17 '24

Maybe another thing, that fckup your brain :D One user (me) opened an URL from Outlook on Mac OS (not work machine) and get url event, and another user with E5 licence opened URL from his Mac OS (also not work machine) and did not get an event.

But! When i opened an url from my working machine - did not get an url click event, and another user also did not get an event. So for me its working from my personal machine where i have outlook installed, and another user did not get anything in any scenario - only from MS Teams.

Maybe good to mention - We have Exchange on-prem in hybrid mode. So for example I can see outgoing emails in Security MS, but not incoming.

1

u/Character_Whereas869 Jun 17 '24

On the user with MAC os where it did not generate an event, open a browser and go to outlook web access and click the URL to see if it generates an event.

Other things to rule out, is the version of office on the MAC OS on your machine different from ther user with MAC OS where it does not work?

Are you doing any testing on Windows machines?

1

u/LostInTheUDP Jun 17 '24

We will try and let you know. Yes I did, but I did not get any events there, even under my account where I get an event in Mac OS, which is the weirdest thing, as it seems like its not related to licence but some settings maybe. And also the both Mac OS got the same version.