Fetch incidents data from Microsoft 365 defender into Power BI through rest API

[Swati20]

I'm trying to fetch incidents data from Microsoft 365 defender into Power BI using the API. But the API is only fetching the incidents from Endpoint source and not from the other sources like defender for CloudApps etc.
Need help in importing all the incidents data from Microsoft 365 defender from all sources and not just from endpoint.

API used: https://api.security.microsoft.com/api/incidents

[Anonymous · Accepted solution]

Hi @Swati20 ,

To pull event data from Microsoft 365 Defender to Power BI from all sources, not just endpoints, you can use the Microsoft Graph security API.

This API allows accessing event data and importing it into Power BI for visualization and analysis.

The steps are similar to:

Open Microsoft Power BI Desktop.

Select Get Data > Blank Query.

Select Advanced Editor.

Paste in Query:

let
    Source = OData.Feed(https://graph.microsoft.com/v1.0/security/alerts_v2, null, [Implementation="2.0"])
in
    Source

Select Done.

When you're prompted for credentials, select Edit Credentials:

Select Organizational account > Sign in.

Enter credentials for account with access to Microsoft Defender XDR incidents data.

Select Connect.

Now the results of your query appear as a table, and you can start building visualizations on top of it.

For more information, please view this document:

Create custom Microsoft Defender XDR reports using Microsoft Graph security API and Power BI | Micro...

If you have any further questions please feel free to contact me.

Best Regards,
Yang
Community Support Team

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!