Forum Discussion
Network Protection Audit
Hi Anonymous,
You can explore the following Microsoft Defender API documentation, which may help with retrieving Network Protection logs and integrating them with Power BI:
Advanced Hunting API - Microsoft Defender for Endpoint | Microsoft Learn
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you.
Super UserHi Anonymous ,
Right now, there isn’t a built-in Power BI connector that lets you pull Defender for Endpoint Audit Mode logs directly, live, from all your machines. But you can still achieve what you’re after, here are the proven approaches most security and compliance teams use:
1. Export Defender Logs to Log Analytics or Event Hub: In Microsoft Defender, set up a scheduled export (either from Advanced Hunting or via the audit logs API) to Azure Log Analytics or Event Hub. In Power BI, use the Azure Monitor Logs connector to connect directly to Log Analytics for reporting and dashboards. This method is scalable and gives you close to real-time insights, covering all endpoints that forward logs.
2. Use Microsoft Sentinel (if available): Forward your Defender logs to Sentinel. Query them centrally with KQL, and connect Power BI using the built-in Kusto connector. This is especially powerful if you need to correlate audit activity with other security events.
3. Manual or Automated Export If you just need periodic reporting, run your KQL queries in Defender’s Advanced Hunting, export results as CSV/JSON, and import them into Power BI. For more automation, use a script or Logic App to regularly push results to Azure Storage, then connect Power BI to that.
At the moment, Microsoft doesn’t offer a direct live connector for Defender Audit logs in Power BI, likely due to scale, security, and data privacy considerations. The above routes (especially via Log Analytics/Sentinel) are the enterprise-standard workarounds.
Hi Rohit,
Yes, the logs are in MS Defender. I wanted to use Power BI to connect directly to that log source, but I don't see a connector for it in Power BI... Yes, I did use Advanced Hunting in Defender and I ran the KQL to view the relevant events... So I guess I will export the results and import into Power BI... I just thought there was a way to connect directly to the log source in Defender, but I don't see that option...? I need to see all the data on a gloabl level not just my machine.