Reference:
https://docs.microsoft.com/en-us/powershell/module/exchange/set-mailbox?view=exchange-ps
https://docs.microsoft.com/en-us/powershell/module/exchange/set-mailboxdatabase?view=exchange-ps

Navigate to the Exchange Admin Center, and then choose the Advanced Threats section of the EAC.
Click the Safe Links tab to examine all existing Safe Links policies:
After navigating to the Safe Links policy page, choose the Add button (+) to create a new policy. The New Safe Links Policy window opens.
- In the resulting window we'll be presented with the options available for creating our new Safe Links policy.
In Name enter an appropriate, unique, name that describes this policy. In the description enter some text that provides a little more detail for anyone trying to make sense of the options selected here.
Next we'll choose the action to take for URLs. We can leave this Off, if for example we are creating a policy to exclude a group of users that would otherwise be affected by another Safe Links policy.
The checkbox Do not track user click can be selected if you do not wish to use the reporting functionality available at a later date. This is a key feature when understanding which users clicked a link that was later found to be a threat, so be careful about choosing to disable user click tracking.
Our final check box provides options for click-through is a link is found to be dangerous. In some circumstances you may trust users to click-through links, or they may request the ability to do so. In most circumstances you will not want a user to click-through the malicious link.
Some URLs, such as those for internal addresses or even trusted partners, may not require re-writing. Enter these URLs here.
Finally, we will select the scope for the rule under the Applied to section.
Using similar conditions to transport rules we can select who this rule applies to including:
- Individual recipients
- Recipient domains
- Members of distribution groups
The same conditions can be used for exceptions. When you have configured your rule, choose Save.
After saving the new Safe Links rule it will be shown in the EAC list. Just like Transport Rules, you can use the Enabled column to enable or disable the Safe Links policy.
Reference:
https://techgenix.com/implementing-exchange-online-advanced-threat-protection-part2/

Reference:
https://docs.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/run-a-message-trace-andview-results
https://docs.microsoft.com/en-us/powershell/module/exchange/mail-flow/get-messagetracedetail?view=exchange-ps

Create a mail flow rule.
Reference:
https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/common-attachmentblocking-scenarios