Created by Claude - please verify

Clicks and ZAP - advanced hunting over UrlClickEvents and EmailPostDeliveryEvents.

Required Microsoft Graph permissions

ThreatHunting.Read.All — application permission, granted to the app registration with admin consent.

Licence: Defender for Office 365 Plan 2.

Endpoint: POST /v1.0/security/runHuntingQuery (UrlClickEvents, EmailPostDeliveryEvents)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Malicious-link Clicks & Mail ZAP Did Not Remove (30 days)

After a phishing wave the first question is: who clicked? This report lists users who clicked through a Safe Links warning or opened a link later found malicious, and mailboxes where zero-hour auto purge tried to remove malicious mail and failed.