@RichBartlett was to fast , seems its still there just slower to report likely due to load :)

@RichBartlett and no :( back again

@RichBartlett seems resolved now

AlertEvidence
| order by TimeGenerated
| where AdditionalFields.SourceEntityId !contains "zoom.us"
| where Title == "A potentially malicious URL click was detected" , non panic edition

@RichBartlett yeah this is going to be very noisy until fixed

@RichBartlett great catch all ours are zoom related also

@RichBartlett we see a uptick also, nothing in search or evidence