Skip to content

Commit 8bbdfe5

Browse files
batamigbatamig
committed
powerbi freshness
1 parent 93e3eac commit 8bbdfe5

File tree

1 file changed

+105
-102
lines changed

1 file changed

+105
-102
lines changed

‎articles/sentinel/powerbi.md

Lines changed: 105 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -1,86 +1,89 @@
11
---
22
title: Create a Power BI report from Microsoft Sentinel data
3-
description: Learn how to create a Power BI report using an exported query from Microsoft Sentinel Log Analytics. Share your report with others in the Power BI service and a Teams channel.
3+
description: Learn how to create a Power BI report using an exported query from Microsoft Sentinel. Share your report with others in the Power BI service and a Teams channel.
44
author: yelevin
55
ms.author: yelevin
6-
ms.topic: conceptual
7-
ms.date: 01/09/2023
6+
ms.topic: how-to
7+
ms.date: 05/19/2024
88
---
99

1010
# Create a Power BI report from Microsoft Sentinel data
1111

1212
[Power BI](https://powerbi.microsoft.com/) is a reporting and analytics platform that turns data into coherent, immersive, interactive visualizations. Power BI lets you easily connect to data sources, visualize and discover relationships, and share insights with whoever you want.
1313

14-
You can base Power BI reports on data from Microsoft Sentinel Log Analytics workspaces, and share those reports with people who don't have access to Microsoft Sentinel. For example, you might want to share information about failed sign-in attempts with app owners, without granting them Microsoft Sentinel access. Power BI visualizations can provide the data at a glance.
14+
You can base Power BI reports on data from Microsoft Sentinel and share those reports with people who don't have access to Microsoft Sentinel. For example, you might want to share information about failed sign-in attempts with app owners, without granting them Microsoft Sentinel access. Power BI visualizations can provide the data at a glance.
15+
16+
Microsoft Sentinel runs on Log Analytics workspaces, and you can use Kusto Query Language (KQL) to query the data.
17+
18+
19+
This article provides a scenario-based procedure to view analysis reports in PowerBI for your Microsoft Sentinel data. For more information, see [Connect data sources](connect-data-sources.md) and [Visualize collected data](get-visibility.md).
1520

1621
In this article, you:
1722

1823
> [!div class="checklist"]
19-
> * Export a Log Analytics Kusto query to a Power BI M language query.
24+
> * Export a KQL query to a Power BI M language query.
2025
> * Use the M query in Power BI Desktop to create visualizations and a report.
2126
> * Publish the report to the Power BI service, and share it with others.
2227
> * Add the report to a Teams channel.
2328
2429
People you granted access in the Power BI service, and members of the Teams channel, can see the report without needing Microsoft Sentinel permissions.
2530

26-
> [!NOTE]
27-
> This article provides a scenario-based procedure to view analysis reports in PowerBI for your Microsoft Sentinel data. For more information, see [Connect data sources](connect-data-sources.md) and [Visualize collected data](get-visibility.md).
28-
>
31+
[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
2932
## Prerequisites
3033

3134
To complete the steps in this article, you need:
3235

33-
- At least read access to a Microsoft Sentinel Log Analytics workspace that monitors sign-in attempts.
34-
- A Power BI account that has read access to the Log Analytics workspace.
36+
- At least read access to a Microsoft Sentinel workspace that monitors sign-in attempts.
37+
- A Power BI account that has read access to the your Microsoft Sentinel workspace.
3538
- [Power BI Desktop installed from the Microsoft Store](https://aka.ms/pbidesktopstore).
3639

37-
## Export a query from Log Analytics
38-
39-
Create, run, and export a Kusto query in your Microsoft Sentinel Log Analytics workspace.
40-
41-
1. To create a simple query, in your Microsoft Sentinel Log Analytics workspace, select **Logs**. In the query editor under **New Query 1**, enter the following Kusto query:
42-
43-
```kusto
44-
SigninLogs
45-
| where TimeGenerated >ago(7d)
46-
| summarize Attempts = count(), Failed=countif(ResultType !=0), Succeeded = countif(ResultType ==0) by AppDisplayName
47-
| top 10 by Failed
48-
| sort by Failed
49-
```
50-
51-
Or, use your favorite Microsoft Sentinel Log Analytics Kusto query.
52-
40+
## Export a query from Microsoft Sentinel
41+
42+
Create, run, and export a KQL query from Microsoft Sentinel.
43+
44+
1. To create a simple query, in Microsoft Sentinel, select **Logs**. If your workspace is onboarded to the unified security operations platform, select **General > Logs**.
45+
46+
1. In the query editor, under **New Query 1**, enter the following query, or any other Microsoft Sentinel query for your data:
47+
48+
```kusto
49+
SigninLogs
50+
| where TimeGenerated >ago(7d)
51+
| summarize Attempts = count(), Failed=countif(ResultType !=0), Succeeded = countif(ResultType ==0) by AppDisplayName
52+
| top 10 by Failed
53+
| sort by Failed
54+
```
55+
5356
1. Select **Run** to run the query and generate results.
54-
55-
:::image type="content" source="media/powerbi/query.png" alt-text="Screenshot showing the Log Analytics Kusto query and results.":::
56-
57-
1. To export the query to Power BI M query format, select **Export**, and then select **Export to Power BI (M query)**. Log Analytics exports the query to a text file called *PowerBIQuery.txt*.
58-
59-
:::image type="content" source="media/powerbi/export.png" alt-text="Screenshot showing query Export to Power BI M format.":::
60-
57+
58+
:::image type="content" source="media/powerbi/query.png" alt-text="Screenshot showing the KQL query and results.":::
59+
60+
1. To export the query to Power BI M query format, select **Export**, and then select **Export to Power BI (M query)**. The query is exported to a text file called *PowerBIQuery.txt*.
61+
62+
:::image type="content" source="media/powerbi/export.png" alt-text="Screenshot showing query Export to Power BI M format.":::
63+
6164
1. Copy the contents of the exported file.
6265

6366
## Get the data in Power BI Desktop
6467

6568
Run the exported M query in Power BI Desktop to get data.
6669

67-
1. Open Power BI Desktop, and sign in to your Power BI account that has read access to the Log Analytics workspace.
68-
69-
:::image type="content" source="media/powerbi/sign-in.png" alt-text="Screenshot showing sign-in to Power BI Desktop.":::
70-
70+
1. Open Power BI Desktop, and sign in to your Power BI account that has read access to your Microsoft Sentinel workspace.
71+
72+
:::image type="content" source="media/powerbi/sign-in.png" alt-text="Screenshot showing sign-in to Power BI Desktop.":::
73+
7174
1. In the Power BI ribbon, select **Get data** and then select **Blank query**. The **Power Query Editor** opens.
72-
73-
:::image type="content" source="media/powerbi/blank-query.png" alt-text="Screenshot showing Blank query selected under Get data in Power BI Desktop.":::
74-
75+
76+
:::image type="content" source="media/powerbi/blank-query.png" alt-text="Screenshot showing Blank query selected under Get data in Power BI Desktop.":::
77+
7578
1. In the **Power Query Editor**, select **Advanced Editor**.
76-
79+
7780
1. Paste the copied contents of the exported *PowerBIQuery.txt* file into the **Advanced Editor** window, and then select **Done**.
78-
79-
:::image type="content" source="media/powerbi/advanced-editor.png" alt-text="Screenshot showing the M query pasted in to the Power BI Advanced Editor.":::
80-
81+
82+
:::image type="content" source="media/powerbi/advanced-editor.png" alt-text="Screenshot showing the M query pasted in to the Power BI Advanced Editor.":::
83+
8184
1. In the **Power Query Editor**, rename the query to *App_signin_stats*, and then select **Close & Apply**.
82-
83-
:::image type="content" source="media/powerbi/close-apply.png" alt-text="Screenshot showing the renamed query and Close & Apply command in the Power Query Editor.":::
85+
86+
:::image type="content" source="media/powerbi/close-apply.png" alt-text="Screenshot showing the renamed query and Close & Apply command in the Power Query Editor.":::
8487

8588
## Create visualizations from the data
8689

@@ -91,117 +94,117 @@ Now that your data is in Power BI, you can create visualizations to provide insi
9194
First, create a table that shows all the results of the query.
9295

9396
1. To add a table visualization to the Power BI Desktop canvas, select the **table** icon under **Visualizations**.
94-
95-
:::image type="content" source="media/powerbi/table.png" alt-text="Screenshot showing the table icon under Visualizations in Power BI Desktop.":::
96-
97+
98+
:::image type="content" source="media/powerbi/table.png" alt-text="Screenshot showing the table icon under Visualizations in Power BI Desktop.":::
99+
97100
1. Under **Fields**, select all the fields in your query, so they all appear in the table. If the table doesn't show all the data, enlarge the table by dragging its selection handles.
98-
99-
:::image type="content" source="media/powerbi/select-fields.png" alt-text="Screenshot showing all fields selected for the table visualization.":::
100-
101+
102+
:::image type="content" source="media/powerbi/select-fields.png" alt-text="Screenshot showing all fields selected for the table visualization.":::
103+
101104
### Create a pie chart
102105

103106
Next, create a pie chart that shows which applications had the most failed sign-in attempts.
104107

105108
1. Deselect the table visual by clicking or tapping outside of it, and then under **Visualizations**, select the **pie chart** icon.
106-
107-
:::image type="content" source="media/powerbi/pie-chart.png" alt-text="Screenshot showing the pie chart icon under Visualizations in Power BI Desktop.":::
108-
109+
110+
:::image type="content" source="media/powerbi/pie-chart.png" alt-text="Screenshot showing the pie chart icon under Visualizations in Power BI Desktop.":::
111+
109112
1. Select **AppDisplayName** in the **Legend** well, or drag it from the **Fields** pane. Select **Failed** in the **Values** well, or drag it from **Fields**. The pie chart now shows the number of failed sign-in attempts per application.
110-
111-
:::image type="content" source="media/powerbi/failed.png" alt-text="Screenshot showing the pie chart with number of failed sign-in attempts per application.":::
112-
113+
114+
:::image type="content" source="media/powerbi/failed.png" alt-text="Screenshot showing the pie chart with number of failed sign-in attempts per application.":::
115+
113116
### Create a new quick measure
114117

115118
You also want to show what percentage of sign-in attempts failed for each application. Since your query doesn't have a percentage column, you can create a new measure to show this information.
116119

117120
1. Under **Visualizations**, select the **stacked column chart** icon to create a stacked column chart.
118-
119-
:::image type="content" source="media/powerbi/column-chart.png" alt-text="Screenshot showing the stacked column chart icon under Visualizations in Power BI Desktop.":::
120-
121+
122+
:::image type="content" source="media/powerbi/column-chart.png" alt-text="Screenshot showing the stacked column chart icon under Visualizations in Power BI Desktop.":::
123+
121124
1. With the new visualization selected, select **Quick measure** in the ribbon.
122-
125+
123126
1. In the **Quick measures** window, under **Calculation**, select **Division**. Drag **Failed** from **Fields** into the **Numerator** field, and drag **Attempts** from **Fields** to **Denominator**.
124-
125-
:::image type="content" source="media/powerbi/quick-measures.png" alt-text="Screenshot showing the settings in the Quick measures window.":::
126-
127+
128+
:::image type="content" source="media/powerbi/quick-measures.png" alt-text="Screenshot showing the settings in the Quick measures window.":::
129+
127130
1. Select **OK**. The new measure appears in the **Fields** pane.
128-
131+
129132
1. Select the new measure in the **Fields** pane, and under **Formatting** in the ribbon, select **Percentage**.
130-
131-
:::image type="content" source="media/powerbi/percentage.png" alt-text="Screenshot showing the new measure selected in the Fields pane, and Percentage selected under Formatting in the ribbon.":::
132-
133+
134+
:::image type="content" source="media/powerbi/percentage.png" alt-text="Screenshot showing the new measure selected in the Fields pane, and Percentage selected under Formatting in the ribbon.":::
135+
133136
1. With the column chart visualization selected on the canvas, select or drag the **AppDisplayName** field into the **Axis** well, and the new **Failed divided by Attempts** measure into the **Values** well. The chart now shows the percentage of failed sign-in attempts for each application.
134-
135-
:::image type="content" source="media/powerbi/failed-percentage.png" alt-text="Screenshot showing the column chart with percentage of failed attempts for each application.":::
136-
137+
138+
:::image type="content" source="media/powerbi/failed-percentage.png" alt-text="Screenshot showing the column chart with percentage of failed attempts for each application.":::
139+
137140
### Refresh the data and save the report
138141

139142
1. Select **Refresh** to get the latest data from Microsoft Sentinel.
140-
141-
:::image type="content" source="media/powerbi/refresh.png" alt-text="Screenshot showing the Refresh button in the ribbon.":::
142-
143+
144+
:::image type="content" source="media/powerbi/refresh.png" alt-text="Screenshot showing the Refresh button in the ribbon.":::
145+
143146
1. Select **File** > **Save** and save your Power BI report.
144147

145148
## Create a Power BI online workspace
146149

147150
To create a Power BI workspace for sharing the report:
148151

149152
1. Sign in to [powerbi.com](https://powerbi.com) with the same account you used for Power BI Desktop and Microsoft Sentinel read access.
150-
153+
151154
1. Under **Workspaces**, select **Create a workspace**. Name the workspace *Management Reports*, and select **Save**.
152-
153-
:::image type="content" source="media/powerbi/create-workspace.png" alt-text="Screenshot showing Create a workspace in the Power BI service.":::
154-
155+
156+
:::image type="content" source="media/powerbi/create-workspace.png" alt-text="Screenshot showing Create a workspace in the Power BI service.":::
157+
155158
1. To grant people and groups access to the workspace, select the **More options** dots next to the new workspace name, and then select **Workspace access**.
156-
157-
:::image type="content" source="media/powerbi/workspace-access.png" alt-text="Screenshot showing Workspace access in the workspace More options menu.":::
158-
159+
160+
:::image type="content" source="media/powerbi/workspace-access.png" alt-text="Screenshot showing Workspace access in the workspace More options menu.":::
161+
159162
1. In the **Workspace access** side pane, you can add users' email addresses and assign each user a role. The roles are Admin, Member, Contributor, and Viewer.
160163

161164
## Publish the Power BI report
162165

163166
Now you can use Power BI Desktop to publish your Power BI report so other people can see it.
164167

165168
1. In your new report in Power BI Desktop, select **Publish**.
166-
167-
:::image type="content" source="media/powerbi/publish.png" alt-text="Screenshot showing Publish in the Power BI Desktop ribbon.":::
168-
169+
170+
:::image type="content" source="media/powerbi/publish.png" alt-text="Screenshot showing Publish in the Power BI Desktop ribbon.":::
171+
169172
1. Select the **Management Reports** workspace to publish to, and select **Select**.
170-
171-
:::image type="content" source="media/powerbi/select-workspace.png" alt-text="Screenshot that shows selecting the Power BI Management Reports workspace to publish to.":::
172-
173+
174+
:::image type="content" source="media/powerbi/select-workspace.png" alt-text="Screenshot that shows selecting the Power BI Management Reports workspace to publish to.":::
175+
173176
## Import the report to a Microsoft Teams channel
174177

175178
You also want members of the Management Teams channel to be able to see the report. To add the report to a Teams channel:
176179

177180
1. In the Management Teams channel, select **+** to add a tab, and in the **Add a tab** window, search for and select **Power BI**.
178181

179-
:::image type="content" source="media/powerbi/add-tab.png" alt-text="Screenshot that shows selecting Power BI in the Add a tab window in Teams.":::
180-
182+
:::image type="content" source="media/powerbi/add-tab.png" alt-text="Screenshot that shows selecting Power BI in the Add a tab window in Teams.":::
183+
181184
1. Select your new report from the list of Power BI reports, and select **Save**. The report appears in a new tab in the Teams channel.
182-
183-
:::image type="content" source="media/powerbi/teams.png" alt-text="Screenshot showing the Power BI report in a tab in the Teams channel.":::
185+
186+
:::image type="content" source="media/powerbi/teams.png" alt-text="Screenshot showing the Power BI report in a tab in the Teams channel.":::
184187

185188
## Schedule report refresh
186189

187190
Refresh your Power BI report on a schedule, so updated data always appears in the report.
188191

189192
1. In the Power BI service, select the workspace you published your report to.
190-
193+
191194
1. Next to the report's dataset, select **More options** > **Settings**.
192-
193-
:::image type="content" source="media/powerbi/settings.png" alt-text="Screenshot showing Settings under More options in the Power BI report dataset.":::
194-
195-
1. Select **Edit credentials** to provide the credentials for an account that has read access to the Log Analytics workspace.
196-
195+
196+
:::image type="content" source="media/powerbi/settings.png" alt-text="Screenshot showing Settings under More options in the Power BI report dataset.":::
197+
198+
1. Select **Edit credentials** to provide the credentials for an account that has read access to the Microsoft Sentinel workspace.
199+
197200
1. Under **Scheduled refresh**, set the slider to **On**, and set up a refresh schedule for the report.
198-
199-
:::image type="content" source="media/powerbi/schedule.png" alt-text="Screenshot showing Scheduled refresh settings for the Power BI report dataset.":::
200201

201-
## Next steps
202+
:::image type="content" source="media/powerbi/schedule.png" alt-text="Screenshot showing Scheduled refresh settings for the Power BI report dataset.":::
203+
204+
## Related content
202205

203206
For more information, see:
204207

205208
- [Azure Monitor service limits](../azure-monitor/service-limits.md)
206209
- [Import Azure Monitor log data into Power BI](../azure-monitor/logs/log-powerbi.md)
207-
- [Power Query M formula language](/powerquery-m/)
210+
- [Power Query M formula language](/powerquery-m/)

0 commit comments

Comments
 (0)