Network Protection Audit

[gm2025]

How do I use Power BI to generate a report that shows details of Network Protection in Audit mode?

Thank you!

[v-saisrao-msft]

Hi @gm2025,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If any of the response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[gm2025]

The options provided did not provide the solution I was looking for,unfortunatley. I had already follow the steps proposed. Again, I'm looking for a report that shows user data activity associated with the Network Protection feature being put in "Audit Mode". I know there is a KQL query but so far it is limited in it's output. 

[v-saisrao-msft]

Hi @gm2025,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-saisrao-msft]

Hi @gm2025,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-saisrao-msft · Accepted solution]

Hi @gm2025,

You can explore the following Microsoft Defender API documentation, which may help with retrieving Network Protection logs and integrating them with Power BI:

Microsoft Defender for Endpoint APIs connection to Power BI - Microsoft Defender for Endpoint | Micr...

Advanced Hunting API - Microsoft Defender for Endpoint | Microsoft Learn

If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.

Thank you.

[gm2025]

Hi Akash,

I was hoping to connect to the system data source within Defender, but Power BI does not seem to have a API to this data source? I will try the manual way you suggested too 🙂

Thank you for your input and suggestions 🙂

[rohit1991]

Hi @gm2025 ,

Right now, there isn’t a built-in Power BI connector that lets you pull Defender for Endpoint Audit Mode logs directly, live, from all your machines. But you can still achieve what you’re after, here are the proven approaches most security and compliance teams use:

1. Export Defender Logs to Log Analytics or Event Hub: In Microsoft Defender, set up a scheduled export (either from Advanced Hunting or via the audit logs API) to Azure Log Analytics or Event Hub. In Power BI, use the Azure Monitor Logs connector to connect directly to Log Analytics for reporting and dashboards. This method is scalable and gives you close to real-time insights, covering all endpoints that forward logs.

2. Use Microsoft Sentinel (if available): Forward your Defender logs to Sentinel. Query them centrally with KQL, and connect Power BI using the built-in Kusto connector. This is especially powerful if you need to correlate audit activity with other security events.

3. Manual or Automated Export If you just need periodic reporting, run your KQL queries in Defender’s Advanced Hunting, export results as CSV/JSON, and import them into Power BI. For more automation, use a script or Logic App to regularly push results to Azure Storage, then connect Power BI to that.

At the moment, Microsoft doesn’t offer a direct live connector for Defender Audit logs in Power BI, likely due to scale, security, and data privacy considerations. The above routes (especially via Log Analytics/Sentinel) are the enterprise-standard workarounds.

[gm2025]

Hi Rohit,

Yes, the logs are in MS Defender. I wanted to use Power BI to connect directly to that log source, but I don't see a connector for it in Power BI... Yes, I did use Advanced Hunting in Defender and I ran the KQL to view the relevant events... So I guess I will export the results and import into Power BI... I just thought there was a way to connect directly to the log source in Defender, but I don't see that option...? I need to see all the data on a gloabl level not just my machine.

[Akash_Varuna]

Hi @gm2025 
First collect audit logs from your network protection system (Microsoft Defender or other tools). Export the logs to a supported format like CSV, JSON, or connect directly to the system's data source.
Then buid the report by importing the data into Power BI, create visuals such as bar charts, or slicers to display events, policies, or compliance details. Apply filters to focus on "Audit mode" entries.
If this post helped please do give a kudos and accept this as a solution
Thanks In Advance