microsoft / microsoftdefenderforendpoint-powerbi

A repo for sample MDATP Power BI Templates

page_type	languages	products	description
sample	kusto	mdatp	Microsoft Defender ATP repository for PowerBI reports

Microsoft Defender ATP PowerBI reports samples

Welcome to the repository for PowerBI reports using Microsoft Defender data! This repository is a starting point for all Microsoft Defender's users to share PowerBI reports that utilizes Microsoft Defender data.

Prerequisites

Download & install PowerBI desktop

Getting started?

Learn to create a Power BI report on top of Microsoft Defender ATP APIs(https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/api-power-bi)

We highly recommend this blog, which helps you getting started and provides a great example on how to use data to create a report (you can download the report from this repository, here)

Share your work

We welcome you to share and contribute, check out the guide in the CONTRIBUTING.md file.

API documentation

For more info on our available APIs - go to our API documentation

Additional Microsoft Defender ATP repositories

We have more repositories for different use cases, we invite you to explore and contribute.

• PowerShell scripts using Microsoft Defender ATP public API

• Microsoft Defender ATP Advanced Hunting (AH) sample queries

• Python scripts using Microsoft Defender ATP public API

microsoftdefenderforendpoint-powerbi's Issues

Error in Application Control

I am getting the following error , when i review the schema at https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference, i don't see a table called MiscEvents. Does anyone know how to fix this query?

Web.Contents failed to get contents from 'https://api.securitycenter.windows.com/api/advancedqueries?key=MiscEvents%0A%7C%20where%20ActionType%20startswith%20'AppControl'%0A%7C%20extend%20ValidatedSigningLevel%20=%20parsejson(AdditionalFields).ValidatedSigningLevel%0A%7C%20extend%20AuthenticodeHash%20=%20parsejson(AdditionalFields).AuthenticodeHash%0A%7C%20project%20FileName,%20ActionType,%20FolderPath,%20ValidatedSigningLevel,%20AuthenticodeHash,%20MachineId,%20EventTime%20%0A%7C%20summarize%20dcount(MachineId)%20by%20FileName,%20EventTime,%20ActionType,%20FolderPath,%20tostring(AuthenticodeHash),%20tostring(ValidatedSigningLevel)%0A%7C%20top%2010000%20by%20dcount_MachineId%20desc' (400): Bad Request.

I'm from Microsoft Power BI support. Need assistance with 1 of these PBITs.

Please contact Leonardo Aguilar Molina on Teams. Thanks!

DataSource.Error: Web.Contents failed to get contents - (400): Bad Request

Hello,

The example "Administration and Management" seems not working today (monday 06-15-2020)
It was working on friday 06-12-2020

2 datasources said the same error :

DataSource.Error: Web.Contents failed to get contents from 'https://api.securitycenter.windows.com/api/advancedqueries?key=MachineInfo%20%7C%20where%20EventTime%20%3E=%20ago(7d)' (400): Bad Request

DataSource.Error: Web.Contents failed to get contents from 'https://api.securitycenter.windows.com/api/advancedqueries?key=MachineInfo%20%7C%20where%20EventTime%20%3E%20ago(7d)%20%7C%20distinct%20MachineId,%20ComputerName,%20ClientVersion,%20PublicIP,%20OSArchitecture,%20OSPlatform,%20OSBuild,%20OsVersion,%20IsAzureADJoined,%20LoggedOnUsers,%20RegistryMachineTag,%20MachineGroup' (400): Bad Request

I don't remember i have change something on my configuration but i could be wrong.

Is there a change in the Microsoft Defender ATP public API ?

Best Regards

ASR Template issues

the ASR template requires a an update and so does the schema

MiscEvents | DeviceEvents

please can someone assist.

Error opening .pbit file

On opening the pbit and doing the initial refresh, this error appears

TVM_DeviceConfigurationAssesmentKB
The column 'RelatedMitreTechniques' of the table wasn't found.

Error in ASR_Rules_Audit_Mode pbit file

This file was originally working fine, but now when I open it an do a refresh of the MDATP_ASR_rules_in_audit_mode_sample__v1.pbit file I get the error

"Web.Contents failed to get contents from 'https://api.securitycenter.windows.com/api/advancedqueries?key=MiscEvents%0D%0A%7C%20where%20%ActionType%20startswith%20%Asr%27%29%20and%20ActionType%20endswith%20%27Audited%27%20' (400): Bad Request"

Please advise. Thanks team.

How to connect to organisation

Hi, I have downloaded these and I have pbit files which open in Power Bi, but the query runs and fails, I suspect because im not logged into my organisation, but I cannot see where I would make the connection, no option to do so is given, can you help?

Old Schemas

Many of these are using an old table schema that no longer works, see https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914 for the announcement. What is the best way to get them fixed?

TVM report templates June 2021

Hi, Thank you for providing nice report.

It seems that some queries of "TVM report templates June 2021" may be incorrect.
https://github.com/microsoft/MicrosoftDefenderForEndpoint-PowerBI/tree/master/TVM/TVM%20report%20templates%20June%202021

The property "TVM_Export_API" and "Machines_API" use the URL about "https://api.securitycenter.windows.com/"
I guess the correct one is "https://api.securitycenter.microsoft.com/". (Using not "windows" but "microsoft")

I had gotten error in PowerBI report , but after fixing URL, I don't get any error meassage.

If my understanding is correct, I hope the query will be fixed.

Thank you.