Attack Simulation Training Insights

@@ -509,7 +509,7 @@ How user activity signals are captured is described in the following table. | Read Message | The user read the simulation message. | Message read signals might experience issues in the following scenarios: <br>- The user reported the message as phishing in Outlook without leaving the reading pane, and **Mark items as read when viewed in the Reading Pane** wasn't configured (default).<br>- The user reported the unread message as phishing in Outlook, the message was deleted, and **Mark messages as read when deleted** wasn't configured (default). |
 | Out of Office | Determines whether the user is out of office. | Currently calculated by the Automatic replies setting from Outlook. |
 | Compromised User | The user was compromised. The compromise signal varies based on the social engineering technique. | - **Credential Harvest**: The user entered their credentials on the sign in page (credentials aren't stored by Microsoft).¹<br>- **Malware Attachment**: The user opened the payload attachment and selected **Enable Editing** in [Protected View](https://support.microsoft.com/office/d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653).<br>- **Link in Attachment**: The user opened the attachment and entered their credentials after clicking on the payload link.<br>- **Link to Malware**: The user clicked on the payload link and entered their credentials.<br>- **Drive by URL**: The user clicked on the payload link (entering credentials isn't required).¹<br>- **OAuth Consent Grant**: The user clicked on the payload link and accepted the prompt to share permissions.¹ |
-| Clicked Message Link | The user clicked on the payload link in the simulation message. For the **Drive-by URL** technique, a click event also leads to compromise. | The URL in the simulation is unique for each user, which allows individual user activity tracking. Non-Microsoft filtering services or email forwarding can lead to false positives. For more information, see [I see clicks or compromise events from users who insist they didn't click the link in the simulation message OR I see clicks within a few seconds of delivery for many users (false positives). What's going on?](attack-simulation-training-faq#i-see-clicks-or-compromise-events-from-users-who-insist-they-didnt-click-the-link-in-the-simulation-message-or-i-see-clicks-within-a-few-seconds-of-delivery-for-many-users-false-positives-whats-going-on) |
+| Clicked Message Link | The user clicked on the payload link in the simulation message. For the **Drive-by URL** technique, a click event also leads to compromise. | The URL in the simulation is unique for each user, which allows individual user activity tracking. Automated inspection of the payload URL by security services, non-Microsoft filtering services, or email forwarding can lead to false positives. Use `EmailLinkClicked_IP`, `EmailLinkClicked_Browser`, `EmailLinkClicked_Device`, and the event timestamp to help distinguish likely user activity from automated inspection. For more information, see [I see clicks or compromise events from users who insist they didn't click the link in the simulation message OR I see clicks within a few seconds of delivery for many users (false positives). What's going on?](attack-simulation-training-faq#i-see-clicks-or-compromise-events-from-users-who-insist-they-didnt-click-the-link-in-the-simulation-message-or-i-see-clicks-within-a-few-seconds-of-delivery-for-many-users-false-positives-whats-going-on) |
 | Forwarded Message | The user forwarded the message. |  |
 | Replied to Message | The user replied to the message. |  |
 | Deleted message | The user deleted the message. | The signal comes from the Outlook activity of the user. If the user reports the message as phishing, the message might be moved to the Deleted Items folder, which is identified as a deletion. |