diff --git a/Tools/MDO Power BI Dashboard/MDO Detection Details Report - v1.22 (Sentinel,LogAnalytics).pbit b/Tools/MDO Power BI Dashboard/MDO Detection Details Report - v1.22 (Sentinel,LogAnalytics).pbit new file mode 100644 index 00000000000..16bac6d62d1 Binary files /dev/null and b/Tools/MDO Power BI Dashboard/MDO Detection Details Report - v1.22 (Sentinel,LogAnalytics).pbit differ diff --git a/Tools/MDO Power BI Dashboard/Media/MDOLA1.png b/Tools/MDO Power BI Dashboard/Media/MDOLA1.png new file mode 100644 index 00000000000..4868952fbf0 Binary files /dev/null and b/Tools/MDO Power BI Dashboard/Media/MDOLA1.png differ diff --git a/Tools/MDO Power BI Dashboard/Media/MDOLA2.png b/Tools/MDO Power BI Dashboard/Media/MDOLA2.png new file mode 100644 index 00000000000..f1d1fe59e86 Binary files /dev/null and b/Tools/MDO Power BI Dashboard/Media/MDOLA2.png differ diff --git a/Tools/MDO Power BI Dashboard/Media/MDOLA3.png b/Tools/MDO Power BI Dashboard/Media/MDOLA3.png new file mode 100644 index 00000000000..7e348e45928 Binary files /dev/null and b/Tools/MDO Power BI Dashboard/Media/MDOLA3.png differ diff --git a/Tools/MDO Power BI Dashboard/Readme.md b/Tools/MDO Power BI Dashboard/Readme.md index 8b230f81293..8f225b71d24 100644 --- a/Tools/MDO Power BI Dashboard/Readme.md +++ b/Tools/MDO Power BI Dashboard/Readme.md @@ -4,18 +4,29 @@ [Overview](#overview)
[Example View of Microsoft Defender for Office 365 (MDO) Detection Details Report](#example-view-of-microsoft-defender-for-office-365-mdo-detection-details-report)
-[How to use the .pbit file](#how-to-use-the-pbit-file)
+[How to use the .pbit file for Log Analytics/Sentinel](#how-to-use-the-pbit-file-for-log-analyticssentinel)
+[How to use the .pbit file for the Hunting API](#how-to-use-the-pbit-file-for-the-hunting-api)
[How to publish to Power BI online and configure scheduled auto-refresh](#how-to-publish-to-power-bi-online-and-configure-scheduled-auto-refresh)
## Overview -This report template will give you an example how to use Microsoft 365 Defender Hunting API to build a custom report using Power BI. This way you can visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs. +These templates will give you an example how to build a Microsoft Defender for Office 365 custom report using Power BI. This way you can visualize Microsoft Defender for Office 365 (MDO) data based on your organization needs. +Sentinel/Log Analytics version: +* Requires the Defender XDR connector in Sentinel for the EmailEvents, EmailPostDeliveryEvents, EmailUrlInfo, UrlClickEvents and CloudAppEvents tables as described here: [Connect data from Microsoft Defender XDR to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDO#connect-events) or a custom solution to push the data into a Log Analytics workspace +* Requires at least read permission for the Log Analytics workspace +* For the maps visuals the Azure Maps option should be enabled in the tenant settings: [Manage Azure Maps Power BI visual within your organization](https://learn.microsoft.com/en-us/azure/azure-maps/power-bi-visual-manage-access) +* Based on the retention of the tables in Log Analytics the data can be stored for up to 12 years [Manage data retention in a Log Analytics workspace](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-configure?tabs=portal-3%2Cportal-1%2Cportal-2#configure-table-level-retention) + +M365D Hunting API version (legacy): +* No longer a fully supported API and can break at any moment, being replaced by the Microsoft Graph security API. Using Microsoft Graph directly in PowerBI is not recommended or supported: [Lack of Support for Microsoft Graph in Power Query](https://learn.microsoft.com/en-us/power-query/connecting-to-graph) * It is using Delegated model to connect to the M365D Hunting API. No need for app registration simply need an admin account which can run the underlying Hunting queries using the API. * Access to the Advanced hunting feature in the M365 Defender portal is needed through appropriate permission and license. * The built-in Security Reader or Security Administrator role is enough to have the report working for example. * Defender for Office 365 Plan 2 standalone or included in Microsoft 365 A5/E5/F5/G5 Security -* This is intended to be a template, we encourage everybody to modify queries, visualisations, bring in more data sets based on organisation needs. + +General considerations: +* These are intended to be a template, we encourage everybody to modify queries, visualizations, bring in more data sets based on organization needs. * The “ReadMe” tab of the template files has more information about terminology used in the template. * This not intended to be a permanent or complete solution rather show an example how to create custom Microsoft Defender for Office 365 (MDO) reports using the hunting API and Power BI. @@ -23,7 +34,13 @@ This report template will give you an example how to use Microsoft 365 Defender ![MDOPowerBI1](Media/MDOPowerBI1.png) -## How to use the .pbit file +## How to use the .pbit file for Log Analytics/Sentinel + +Opening the .pbit file will prompt for the Log Analytics Workspace ID at first run.

![MDOLA1](Media/MDOLA1.png)

+It can be found in the Azure Portal on the Log Analytics page:

![MDOLA2](Media/MDOLA2.png)

+After that make sure you sign in with the “Organization account” with permissions to the Log Analytics Workspace:

![MDOLA3](Media/MDOLA3.png)

+ +## How to use the .pbit file for the Hunting API Using the .pbit file will load the template with no data and ask for Authentication at first run. Power BI will ask for connect/Authenticate to the data source (Hunting API in M365D)

![MDOPowerBI2](Media/MDOPowerBI2.png)