KQL to report on sites used with Internet Explorer. Use with Defender for Endpoint Advanced Hunting https://blog.alexmags.com/posts/internet-explorer-eol-kql/

intranetSitesUsedWithIE.KQL

DeviceNetworkEvents  
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName =~ 'iexplore.exe'
    and RemoteUrl contains ".intranet domain here"
    and RemoteUrl !contains "proxy url here"
    //and RemoteUrl !contains "other thing to filter out"
    // chop off http:// or https://
| extend URLwithoutProtocol=replace_string(replace_string(RemoteUrl, 'http://', ''), 'https://', '')
    | extend splitURL=split(URLwithoutProtocol,'/')
    | extend domain=tostring(splitURL[0])
    | summarize by InitiatingProcessAccountUpn,domain
    | summarize count() by domain
| order by count_ desc
//| top 15 by count_
//| render columnchart