// Defender XDR Advanced Hunting. Read-only; not live-tested.
let TargetMessageId = "REPLACE_WITH_REVIEWED_NETWORK_MESSAGE_ID";
UrlClickEvents
| where Timestamp between (ago(7d) .. now())
| where NetworkMessageId == TargetMessageId
| project Timestamp, NetworkMessageId, AccountUpn, Url,
    ActionType, ThreatTypes, Workload
| order by Timestamp desc
| take 500