Forum Discussion
How to Import Attack Simulation Training Data from Microsoft Defender into Power BI?
I'm trying to create a security dashboard in Power BI and need assistance with importing attack simulation training data from Microsoft Defender. Specifically, I'm looking to include annual cybersecurity training information, phishing simulation compromised user rates, report rates, and simulation training details. Any guidance on how to achieve this would be greatly appreciated.
Christinem12345, To integrate Attack Simulation Training data from Microsoft Defender for Office 365 into Power BI, you can utilize the Microsoft Graph API to programmatically access detailed simulation reports. This approach allows you to retrieve comprehensive data on compromised users, users who reported phishing attempts, training completions, and more.
Access Simulation Reports:
Endpoint: https://graph.microsoft.com/v1.0/security/attackSimulation/simulations/{simulationId}/report/simulationUsers. Replace {simulationId} with the ID of the specific simulation you're interested in.
- Connect Power BI to Microsoft Graph API:
- In Power BI Desktop, use the Web connector to fetch data from the Microsoft Graph API endpoints. Input the API URL and include the access token in the HTTP request header for authentication. Transform and model the data as needed to create insightful visualizations.
Additional Resources:
Microsoft Graph API Documentation: Provides detailed information on accessing attack simulation data:
Power BI Integration: Guidance on connecting Power BI to Microsoft Defender for Endpoint APIs, which is applicable to other Microsoft Graph API integrations: Create custom reports using Power BI
Thanks,
Prashanth Are
MS Fabric community support
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query
10 Replies
Hi Christinem12345 ,
You can access Microsoft Defender data through APIs.
https://learn.microsoft.com/en-us/defender-endpoint/api/api-power-bi
Did I answer your question? Mark my post as a solution!
I am specifically looking for information on the attack simulation training. I was already able to get queries from Microsoft Defender. Thank you!
Hi Christinem12345,
Can you please refer to below Microsoft official learn resources and let me know if this helps?
https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started
Thanks,
Prashanth Are
MS Fabric community support
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query
Christinem12345, As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by our super users for your issue worked? or let us know if you need any further assistance here?
MattiaFratello, Thanks for your promt response
Thanks,
Prashanth Are
MS Fabric community support
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query
Christinem12345, As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by our super users for your issue worked? or let us know if you need any further assistance here?
Thanks,
Prashanth Are
MS Fabric community support
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query
Hello! I am still looking for help on this issue. I would like to have the recent attack simulation into Powerbi. I would like to have the compromised users, users who reported, people who completed the training, people who clicked the message, and other items from what is given in attack simulation.
Christinem12345, To integrate Attack Simulation Training data from Microsoft Defender for Office 365 into Power BI, you can utilize the Microsoft Graph API to programmatically access detailed simulation reports. This approach allows you to retrieve comprehensive data on compromised users, users who reported phishing attempts, training completions, and more.
Access Simulation Reports:
Endpoint: https://graph.microsoft.com/v1.0/security/attackSimulation/simulations/{simulationId}/report/simulationUsers. Replace {simulationId} with the ID of the specific simulation you're interested in.
- Connect Power BI to Microsoft Graph API:
- In Power BI Desktop, use the Web connector to fetch data from the Microsoft Graph API endpoints. Input the API URL and include the access token in the HTTP request header for authentication. Transform and model the data as needed to create insightful visualizations.
Additional Resources:
Microsoft Graph API Documentation: Provides detailed information on accessing attack simulation data:
Power BI Integration: Guidance on connecting Power BI to Microsoft Defender for Endpoint APIs, which is applicable to other Microsoft Graph API integrations: Create custom reports using Power BI
Thanks,
Prashanth Are
MS Fabric community support
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query
