Guest User

Defender 365 ASR PowerBI Query

a guest
Mar 13th, 2023
64
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.45 KB | Software | 0 0
  1. let
  2. AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Asr'",
  3.  
  4. HuntingUrl = "https://api.securitycenter.microsoft.com/api/advancedhunting",
  5.  
  6. Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])),
  7.  
  8. TypeMap = #table(
  9. { "Type", "PowerBiType" },
  10. {
  11. { "Double", Double.Type },
  12. { "Int64", Int64.Type },
  13. { "Int32", Int32.Type },
  14. { "Int16", Int16.Type },
  15. { "UInt64", Number.Type },
  16. { "UInt32", Number.Type },
  17. { "UInt16", Number.Type },
  18. { "Byte", Byte.Type },
  19. { "Single", Single.Type },
  20. { "Decimal", Decimal.Type },
  21. { "TimeSpan", Duration.Type },
  22. { "DateTime", DateTimeZone.Type },
  23. { "String", Text.Type },
  24. { "Boolean", Logical.Type },
  25. { "SByte", Logical.Type },
  26. { "Guid", Text.Type }
  27. }),
  28.  
  29. Schema = Table.FromRecords(Response[Schema]),
  30. TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}),
  31. Results = Response[Results],
  32. Rows = Table.FromRecords(Results, Schema[Name]),
  33. Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}}))
  34.  
  35. in Table
Advertisement
Add Comment
Please, Sign In to add comment