How to Import Attack Simulation Training Data from Microsoft Defender into Power BI?

[Christinem12345]

I'm trying to create a security dashboard in Power BI and need assistance with importing attack simulation training data from Microsoft Defender. Specifically, I'm looking to include annual cybersecurity training information, phishing simulation compromised user rates, report rates, and simulation training details. Any guidance on how to achieve this would be greatly appreciated.

[v-prasare]

@Christinem12345, As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by our super users for your issue worked? or let us know if you need any further assistance here? 

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[Christinem12345]

Hello! I am still looking for help on this issue. I would like to have the recent attack simulation into Powerbi. I would like to have the compromised users, users who reported, people who completed the training, people who clicked the message, and other items from what is given in attack simulation. 

[v-prasare]

@Christinem12345, To integrate Attack Simulation Training data from Microsoft Defender for Office 365 into Power BI, you can utilize the Microsoft Graph API to programmatically access detailed simulation reports. This approach allows you to retrieve comprehensive data on compromised users, users who reported phishing attempts, training completions, and more.

Access Simulation Reports:

Endpoint: https://graph.microsoft.com/v1.0/security/attackSimulation/simulations/{simulationId}/report/simulat.... Replace {simulationId} with the ID of the specific simulation you're interested in.

1. Connect Power BI to Microsoft Graph API:
• In Power BI Desktop, use the Web connector to fetch data from the Microsoft Graph API endpoints. Input the API URL and include the access token in the HTTP request header for authentication. Transform and model the data as needed to create insightful visualizations.

Additional Resources:

Microsoft Graph API Documentation: Provides detailed information on accessing attack simulation data:

• List Simulations
• Simulation User Report

Power BI Integration: Guidance on connecting Power BI to Microsoft Defender for Endpoint APIs, which is applicable to other Microsoft Graph API integrations: Create custom reports using Power BI

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[v-prasare]

@Christinem12345,  we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by our super users for your issue worked? or let us know if you need any further assistance here? 

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[v-prasare]

@Christinem12345, As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by our super users for your issue worked? or let us know if you need any further assistance here?

@MattiaFratello, Thanks for your promt response

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[MattiaFratello]

Hi @Christinem12345 ,

You can access Microsoft Defender data through APIs.

https://learn.microsoft.com/en-us/defender-endpoint/api/api-power-bi

Did I answer your question? Mark my post as a solution!

[Christinem12345]

I am specifically looking for information on the attack simulation training. I was already able to get queries from Microsoft Defender. Thank you!

[v-prasare]

Hi @Christinem12345,

Can you please refer to below Microsoft official learn resources and let me know if this helps?

https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[Christinem12345]

Hello Prashanth! I am looking to integrate the data from the recent attack simulation into Powerbi. I would want the compromised users, users who reported, people who completed the training, people who clicked hte message, and other stuff along the lines of that.