EmailEvents
| where Timestamp > ago(1d)
| where DeliveryAction == "Delivered"
| where ThreatTypes has "Phish" or DetectionMethods has_any ("URL detonation", "URL reputation")
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, ThreatTypes, DetectionMethods, DeliveryAction
| sort by Timestamp desc