Power BI for Azure ATP advanced Hunting, query for Failed Logon

Hrm... not too familar with ATP.

You could try changing:

[Query=[key=AdvancedHuntingQuery]]

to:

[Query=[key=AdvancedHuntingQuery, properties=[Options=[truncationmaxrecords=100000]]]]

Thanks for the suggestion.  I tried to add to my query but got syntax error.

Query > security.microsoft.com > advanced hunting:

IdentityLogonEvents

| where LogonType == "Failed logon" and isnotempty(AccountName)

| project LogonTime = Timestamp, LogonType, Application, FailureReason, AccountName, AccountUpn, DeviceName, DestinationDeviceName

Not sure there is a way to add the properties, I'll try a few other ways but I'm not an KQL guru.

Cheers,

Serge

well, I think I found the issue as far as connecting Power BI to the correct Advanced Hunting schema.

Looking at https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/api-power-bi#connect-power-bi-to-advanced-hunting-api

it appears there is not an api created from Power BI to https://security.microsoft.com/advanced-hunting 

I guess we will need to see how to collect the data into a cluster someone and then connect to the cluster to run our query for Failed Logon.

Any advice/suggestions would be appreciated.

Cheers,

Serge