Forum Discussion
Defender API data not populating in PowerBI
Hello,
My team is trying to create a PowerBI dashboard utilizing microsoft defender incident data (security.microsoft.com) .
We created an API connection through the OData feed source: OData.Feed("https://api.security.microsoft.com/api/incidents", null, [Implementation="2.0"])
Most of the incidents I see on the defender portal are ingested into PowerBI, however, it is missing insidents from the Insider Risk Management source, and I am only able to see DLP incidents for some reason. We have tried numerous troubleshootings with no success, any help would be appreciated.
Below I have attached screenshots of what the power BI raw data that we're getting from defender looks like vs what the microsoft defender protal is showing.
Defender Portal:
PowerBI Source Data:
Hi Anonymous
Thank you for reaching out microsoft fabric community forum.- The Microsoft Defender API (https://api.security.microsoft.com/api/incidents) does not include Insider Risk Management (IRM) incidents.
- IRM incidents are managed under Microsoft Purview and are separated due to privacy and compliance boundaries.
- DLP incidents appear because they are shared between Microsoft Defender and Microsoft Purview.
- To access IRM data, you need to use Microsoft Graph API under the Purview (compliance) umbrella, such as https://graph.microsoft.com/beta/security/insiderRiskCases.
- Microsoft Graph API access requires appropriate Azure AD app registration and permissions like InsiderRiskManagement.Read.All.
- Manual export from the Insider Risk Management portal (CSV) can be used as a workaround if API access isn't feasible.
- Accessing IRM data requires Microsoft 365 E5 Compliance or E5 Security licensing.
- The user accessing the data must have roles such as Insider Risk Management Admin or Compliance Admin.
- Document this limitation in your Power BI dashboard so stakeholders are aware that IRM incidents are excluded due to API constraints.
- Use a custom connector or a Graph API query to bring IRM data into Power BI if automation is required
If this solution helps, please consider giving us Kudos and accepting it as the solution so that it may assist other members in the community
Thank you.
4 Replies
Hi Anonymous
Thank you for reaching out microsoft fabric community forum.- The Microsoft Defender API (https://api.security.microsoft.com/api/incidents) does not include Insider Risk Management (IRM) incidents.
- IRM incidents are managed under Microsoft Purview and are separated due to privacy and compliance boundaries.
- DLP incidents appear because they are shared between Microsoft Defender and Microsoft Purview.
- To access IRM data, you need to use Microsoft Graph API under the Purview (compliance) umbrella, such as https://graph.microsoft.com/beta/security/insiderRiskCases.
- Microsoft Graph API access requires appropriate Azure AD app registration and permissions like InsiderRiskManagement.Read.All.
- Manual export from the Insider Risk Management portal (CSV) can be used as a workaround if API access isn't feasible.
- Accessing IRM data requires Microsoft 365 E5 Compliance or E5 Security licensing.
- The user accessing the data must have roles such as Insider Risk Management Admin or Compliance Admin.
- Document this limitation in your Power BI dashboard so stakeholders are aware that IRM incidents are excluded due to API constraints.
- Use a custom connector or a Graph API query to bring IRM data into Power BI if automation is required
If this solution helps, please consider giving us Kudos and accepting it as the solution so that it may assist other members in the community
Thank you.