AlertEvidence
| order by TimeGenerated
| where AdditionalFields.SourceEntityId !contains "zoom.us"
| where Title == "A potentially malicious URL click was detected" , non panic edition