// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Who clicked a link in those lures? Each row is a person to contact and, if they typed card details, a card to cancel.
// Safe Links must be on for clicks to be recorded; clicks from mail in Drafts or Sent Items cannot be joined.
let Since = datetime(2026-10-14);
let PlatformSenders = dynamic(["news@arara.com", "info@cuenote.jp"]);
let Lures = EmailEvents
    | where Timestamp >= Since and EmailDirection == "Inbound"
    | where SenderFromAddress in~ (PlatformSenders)
        or Subject contains "利用内容確認のご依頼"
        or Subject contains "ご利用明細確認のご依頼"
        or Subject contains "ご利用確認のお願い"
    | distinct NetworkMessageId, SenderFromAddress, Subject;
UrlClickEvents
| where Timestamp >= Since and Workload == "Email"
| join kind=inner Lures on NetworkMessageId
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough, SenderFromAddress, Subject
| order by Timestamp desc