Network Protection Audit

[gm2025]

How do I use Power BI to generate a report that shows details of Network Protection in Audit mode?

Thank you!

[v-saisrao-msft]

Hi @gm2025,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If any of the response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[gm2025]

The options provided did not provide the solution I was looking for,unfortunatley. I had already follow the steps proposed. Again, I'm looking for a report that shows user data activity associated with the Network Protection feature being put in "Audit Mode". I know there is a KQL query but so far it is limited in it's output. 

[v-saisrao-msft]

Hi @gm2025,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-saisrao-msft]

Hi @gm2025,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-saisrao-msft]

Hi @gm2025,

You can explore the following Microsoft Defender API documentation, which may help with retrieving Network Protection logs and integrating them with Power BI:

Microsoft Defender for Endpoint APIs connection to Power BI - Microsoft Defender for Endpoint | Micr...

Advanced Hunting API - Microsoft Defender for Endpoint | Microsoft Learn

If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.

Thank you.

[gm2025]

Hi Akash,

I was hoping to connect to the system data source within Defender, but Power BI does not seem to have a API to this data source? I will try the manual way you suggested too 🙂

Thank you for your input and suggestions 🙂

[rohit1991]

Hi @gm2025 ,
To generate a Power BI report that shows details of Network Protection in Audit mode, you can start by collecting the relevant data from Microsoft Defender for Endpoint or Windows Security logs. If using Microsoft Defender for Endpoint, you can access Network Protection audit logs via Microsoft Defender Advanced Hunting in the Microsoft 365 Defender portal, using Kusto Query Language (KQL) to extract relevant events. 

Alternatively, if logs are stored in Event Viewer, specifically under Microsoft-Windows-Windows Defender/Operational, you can use a Power BI gateway to connect and import the logs. Once the data is in Power BI, you can create visualizations such as tables, bar charts, or line graphs to display details like timestamps, affected devices, IP addresses, and action outcomes. Applying filters and drill-through options can help analyze specific security events. If logs are stored in a centralized database or SIEM (e.g., Microsoft Sentinel), connecting Power BI to that source via direct query can provide real-time insights.

[gm2025]

Hi Rohit,

Yes, the logs are in MS Defender. I wanted to use Power BI to connect directly to that log source, but I don't see a connector for it in Power BI... Yes, I did use Advanced Hunting in Defender and I ran the KQL to view the relevant events... So I guess I will export the results and import into Power BI... I just thought there was a way to connect directly to the log source in Defender, but I don't see that option...? I need to see all the data on a gloabl level not just my machine.

[Akash_Varuna]

Hi @gm2025 
First collect audit logs from your network protection system (Microsoft Defender or other tools). Export the logs to a supported format like CSV, JSON, or connect directly to the system's data source.
Then buid the report by importing the data into Power BI, create visuals such as bar charts, or slicers to display events, policies, or compliance details. Apply filters to focus on "Audit mode" entries.
If this post helped please do give a kudos and accept this as a solution
Thanks In Advance