// Microsoft Defender XDR Advanced Hunting; read-only; not live-tested.
// Safe Links coverage is required. Absence of results is not a no-click verdict.
let MessageId = "REPLACE_WITH_NETWORK_MESSAGE_ID";
UrlClickEvents
| where Timestamp >= ago(7d)
| where NetworkMessageId == MessageId
| where Workload == "Email"
| project Timestamp, AccountUpn, NetworkMessageId, Url,
    ActionType, IsClickedThrough
| order by Timestamp desc
| take 500