https://community.fabric.microsoft.com/t5/Developer/400-Bad-Request-MS-Defender-Connection/m-p/2885062#M39565 <P>Dear Community,&nbsp;</P><P>&nbsp;</P><P>I am quite new to PowerBI .</P><P>&nbsp;</P><P>&nbsp;</P><P>I am trying to use a Microsoft shared MS Defender report &nbsp;(<A href="https://github.com/Azure/Azure-Sentinel/tree/master/Tools/MDO%20Power%20BI%20Dashboard#how-to-use-the-pbit-file" target="_blank" rel="noopener">https://github.com/Azure/Azure-Sentinel/tree/master/Tools/MDO%20Power%20BI%20Dashboard#how-to-use-the-pbit-file)&nbsp;&nbsp;</A></P><P>&nbsp;</P><P>We are an MS Defender Customer and I have PowerBI Pro license .&nbsp;</P><P>&nbsp;</P><P>The problem is that when I open the report in PowerBI Desktop, I receive the following error for every table that the report is using i.e. :</P><P><EM>Web.Contents failed to get contents from '<A href="https://api.security.microsoft.com/api/advancedhunting/?key=EmailEvents%20%7C%20where%20Timestamp%20%3Eago(30d)%20%7C%20where%20isnotempty(ThreatTypes)%20%7C%20summarize%20count()%20by%20SenderFromDomain,%20bin(Timestamp,%201d)%20%7C%20sort%20by%20count_%20%20%7C%20take%2015" target="_blank" rel="noopener">https://api.security.microsoft.com/api/advancedhunting/?key=EmailEvents%20%7C%20where%20Timestamp%20%3Eago(30d)%20%7C%20where%20isnotempty(ThreatTypes)%20%7C%20summarize%20count()%20by%20SenderFromDomain,%20bin(Timestamp,%201d)%20%7C%20sort%20by%20count_%20%20%7C%20take%2015</A>' (400): Bad Request</EM></P><P>&nbsp;</P><P>I suspect that it has to do something with the MS Defender Schema...anyway ideas or how to correct it or how to troubleshoot ?</P><P>&nbsp;</P><P>Does the PowerBI Desktop has any more detailed debug logs ?</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 04 Nov 2022 09:05:11 GMT mbelsis 2022-11-04T09:05:11Z https://community.fabric.microsoft.com/t5/Developer/400-Bad-Request-MS-Defender-Connection/m-p/2885062#M39565 <P>Dear Community,&nbsp;</P><P>&nbsp;</P><P>I am quite new to PowerBI .</P><P>&nbsp;</P><P>&nbsp;</P><P>I am trying to use a Microsoft shared MS Defender report &nbsp;(<A href="https://github.com/Azure/Azure-Sentinel/tree/master/Tools/MDO%20Power%20BI%20Dashboard#how-to-use-the-pbit-file" target="_blank" rel="noopener">https://github.com/Azure/Azure-Sentinel/tree/master/Tools/MDO%20Power%20BI%20Dashboard#how-to-use-the-pbit-file)&nbsp;&nbsp;</A></P><P>&nbsp;</P><P>We are an MS Defender Customer and I have PowerBI Pro license .&nbsp;</P><P>&nbsp;</P><P>The problem is that when I open the report in PowerBI Desktop, I receive the following error for every table that the report is using i.e. :</P><P><EM>Web.Contents failed to get contents from '<A href="https://api.security.microsoft.com/api/advancedhunting/?key=EmailEvents%20%7C%20where%20Timestamp%20%3Eago(30d)%20%7C%20where%20isnotempty(ThreatTypes)%20%7C%20summarize%20count()%20by%20SenderFromDomain,%20bin(Timestamp,%201d)%20%7C%20sort%20by%20count_%20%20%7C%20take%2015" target="_blank" rel="noopener">https://api.security.microsoft.com/api/advancedhunting/?key=EmailEvents%20%7C%20where%20Timestamp%20%3Eago(30d)%20%7C%20where%20isnotempty(ThreatTypes)%20%7C%20summarize%20count()%20by%20SenderFromDomain,%20bin(Timestamp,%201d)%20%7C%20sort%20by%20count_%20%20%7C%20take%2015</A>' (400): Bad Request</EM></P><P>&nbsp;</P><P>I suspect that it has to do something with the MS Defender Schema...anyway ideas or how to correct it or how to troubleshoot ?</P><P>&nbsp;</P><P>Does the PowerBI Desktop has any more detailed debug logs ?</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 04 Nov 2022 09:05:11 GMT https://community.fabric.microsoft.com/t5/Developer/400-Bad-Request-MS-Defender-Connection/m-p/2885062#M39565 mbelsis 2022-11-04T09:05:11Z https://community.fabric.microsoft.com/t5/Developer/400-Bad-Request-MS-Defender-Connection/m-p/2888711#M39596 <P>Hi&nbsp;<a href="https://community.fabric.microsoft.com/t5/user/viewprofilepage/user-id/466899">@mbelsis</a>&nbsp;,</P> <P>&nbsp;</P> <P>You can follow the step as below to diagnostic logs in Power BI Desktop.</P> <P>File&gt; Options and settings &gt; Options &gt; Diagnostics</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="RicoZhou_0-1667811267207.png" style="width: 400px;"><img src="https://community.fabric.microsoft.com/t5/image/serverpage/image-id/817982iD9E033731EDD7496/image-size/medium?v=v2&amp;px=400" role="button" title="RicoZhou_0-1667811267207.png" alt="RicoZhou_0-1667811267207.png" /></span></P> <P>For reference:</P> <P><A href="https://learn.microsoft.com/en-us/power-bi/fundamentals/desktop-diagnostics" target="_self">Power BI Desktop diagnostics collection</A></P> <P>Here is an <A href="https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-error-codes?view=o365-worldwide" target="_self">offical blog</A> about common Microsoft 365 Defender REST API error codes. I hope it could help you solve your issue.</P> <P>&nbsp;</P> <P>Best Regards,<BR />Rico Zhou</P> <P>&nbsp;</P> <P>If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.</P> Mon, 07 Nov 2022 08:59:41 GMT https://community.fabric.microsoft.com/t5/Developer/400-Bad-Request-MS-Defender-Connection/m-p/2888711#M39596 Anonymous 2022-11-07T08:59:41Z