From 8d45fba6d44d9cfe313c22464ff99000323bed5d Mon Sep 17 00:00:00 2001 From: David Laufer Date: Thu, 23 Aug 2018 14:34:33 +0300 Subject: [PATCH] Add tutorial to run Power BI with user token --- .../windows-defender-atp/TOC.md | 2 +- .../exposed-apis-create-app-nativeapp.md | 2 +- .../exposed-apis-create-app-webapp.md | 2 +- ...=> power-bi-set-credentials-anonymous.png} | Bin ...bi-set-credentials-organizational-cont.png | Bin 0 -> 14831 bytes ...ower-bi-set-credentials-organizational.png | Bin 0 -> 14222 bytes ...ows-defender-advanced-threat-protection.md | 2 +- ...vanced-query-sample-power-bi-app-token.md} | 9 +- ...vanced-query-sample-power-bi-user-token.md | 112 ++++++++++++++++++ 9 files changed, 122 insertions(+), 7 deletions(-) rename windows/security/threat-protection/windows-defender-atp/images/{power-bi-set-credentials.png => power-bi-set-credentials-anonymous.png} (100%) create mode 100644 windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational-cont.png create mode 100644 windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational.png rename windows/security/threat-protection/windows-defender-atp/{run-advanced-query-sample-power-bi.md => run-advanced-query-sample-power-bi-app-token.md} (91%) create mode 100644 windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 5fca7a6375..3aabd75f2e 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -157,7 +157,7 @@ ##### [Schedule advanced Hunting using Microsoft Flow](run-advanced-query-sample-ms-flow.md) ##### [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) ##### [Advanced Hunting using Python](run-advanced-query-sample-python.md) -##### [Create custom Power BI reports](run-advanced-query-sample-power-bi.md) +##### [Create custom Power BI reports](run-advanced-query-sample-power-bi-app-token.md) ### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md index f3d72bd653..06c9891fa8 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md @@ -124,7 +124,7 @@ The code was below tested with nuget Microsoft.IdentityModel.Clients.ActiveDire ``` const string authority = "https://login.windows.net"; - const string wdatpResourceId = "https://api.securitycenter.windows.com/"; + const string wdatpResourceId = "https://api.securitycenter.windows.com"; string tenantId = "00000000-0000-0000-0000-000000000000"; // Paste your own tenant ID here string appId = "11111111-1111-1111-1111-111111111111"; // Paste your own app ID here diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md index 20e0d808b8..8d0dee467f 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md @@ -152,7 +152,7 @@ For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.co string appSecret = "22222222-2222-2222-2222-222222222222"; // Paste your own app secret here for a test, and then store it in a safe place! const string authority = "https://login.windows.net"; - const string wdatpResourceId = "https://api.securitycenter.windows.com/"; + const string wdatpResourceId = "https://api.securitycenter.windows.com"; AuthenticationContext auth = new AuthenticationContext($"{authority}/{tenantId}/"); ClientCredential clientCredential = new ClientCredential(appId, appSecret); diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-anonymous.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials.png rename to windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-anonymous.png diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational-cont.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational-cont.png new file mode 100644 index 0000000000000000000000000000000000000000..049d3ed6ee5bd85a6eaa994bb4281f6ae65af0b6 GIT binary patch literal 14831 zcmcJ$dpy&B|1iFe6dfd|4^o8W6mp21Pl*sQr&(bXMrd-V_t`*&U6-|zd!9(x~Nhv)hAJiVV=nj0TG`qxna0C3FY znt>GnupbKm?BioU%z9F86Z?Yow=clTSPxLqBQ(dlIq0E#Ll*$3is#t6bBJ|+JRQm+$*09|!h#?B}|8>dwv==O)snwMpK`eBab1>bZm~)4Jq4K7GxJoHuKNRkcN)nv#Kl1T*V>2IYUrZ+G{ncExEn&&VFCFkCh8=z z2o?93AAA-Dbw}?MPINBV8UTMU_^5knVp0L-9pWI&k?(&#`dS(L{R^|AiANTU;ro^g zQbx<8EB>IGF`-`*Waft2!q|b%Q6*!Y7*B}kv7S>Tx(_03bMD((>{cpu>eK}*VCv8- zi0mwP&vmY~Hh=rd>anAf&_Y?kuETsT!sy;o?Qgwvq#m`DQ;P#LvGyeX)72xGELUR1 zhAUCU2QbBsGKD_?+~!tO%6)q&&1&Ywd~Pi{6k!vo6eExmX@*_>A#NYM%eTNYZ~8>6!DU@!6Wn zHR2CO&}N-?0Cs5oc5KGfJw^p7t*JRGpW*)h<47ArnoX%hK3eAJ1g#iYegln zcN_`K7Ao?)h#)aCOHaO-T=q+JPv~@VKD6Hxw>w6>__GE_wv(Pr8a(aGC!OqHUT$6R z>Q0)M1C=pye&E|xxO_1*`TGxs!z(co+3$I~Pw9J=HlnXIibG@HPSL@0=72XMBW^vZ z<{DH74x3=84~^cfj_C4se`o0!demUciA!}D(IlUq&Tv(%;L=^KY=+8vp@Sg{%GimJ zh9<7z9k(GlO#2lS$L(v0!(o3HBrW!Q!e{n75HH)?1p9G^Nr%CV5Gp;t%)VoFC=#~H zi?Mt!TQC+~7J~1SB6%G0`+CLaA?Nk7VO~hqR1md6T_pi@gNQDX&u>Q-3zDqi)T%`? z8{qDf|CXNpTgv!9KS=55R-g8Ea$Nu|yeI|;9H>NW7cgdLcl)4ZJ8Cm099r#1P;7wWJWTe+m$i|#`qUf{^+yOY+F39 zwhS-eY`E5~7<`=6nZb8$P-RVp^4&)Ljr%u+HPA)9Mtk}_m()A7W4_JsC0nTiwQq)R zw~m(<6Sb|WyBoV*Dx2#YzPsu6;Q{nYvnx{L$yJGDV+tLaZN;(vqVHu!$`H=>`MdTpJ$T^7J?jrTH#8Nti`SM)OHp6yCjF=z4Y%8E zr1*+dW`slR2a)x`G)ebH+csTzXwRpzQjDC46_QO=v)WY`9vs9>orJzs=X!?P|0nFluvRylP z5}#AB3mBL)`r5kpOe&PEKd*xM-Z8MFIk5j*>y)RzRp){=b1loV5qzVhz2+r$U{3ob zn6&ZhNBWw;t0>ih^g`Yg3~W09Ml%{N5QowHs>ol!OjX{`QIxFw7|KSTa3P{Dn;XU^ z8?SBU+m-pn^(;h!-YD7MN?lJGl4*9Oe-(sf95oMY8(Ft=7lu%GNMFuf}awqMWVhZp=EyLzoHZ z>dkrZD83PfZ?MP*D^VgAck@0N?uJfI(!YmEjnwQsugk}mlu*BOcvflM8Nis6=-9vo z1(-=~-&)Iuyx5w0JL=;Ud|T|jbuIe9P^S9PL5NVEQ?^-DFBj+P+a^ zeCzVH93?^wUyS+-bWa2Et}%V%s#9#_8QK&day8(Y7}lSdssz^(9idotqku!a7-*Eo7GJ+FSJm5uVw)3&v9v6j~Qfs*YI zL`kU|R6HPtRLwl9I+ktSE5Bojux+rrYP()xCUB=X{)+{Zz&GM@uBmXyytre|k`8V2gTRG1jV2BC01ryTC;71 zh~Sho(8&U&FEe{0oE>z>s8NP+sLj{99WCAO=OxVQ?))Ri{REWDBlD{`g;%631bS@ z*?JLm-7%8=y0o1>*QLcIbwtQ@;nE26xGJznv&_b*qh-`6O=NZHp|VDxQxEW&rcA{C`B>2QV_du8Uu%zOghNEF6hb|{%6!m-N zQfE2>ks+QF6)SqSsEWlN5i4+omRP@hfd#tTf7K|D@?{1iivO~@a)?_BJ6m68le$p2 zt$6S)J7Y9E3`IwZ=HXI_%?_4=fqGxrWCvR(#kgWuFsr6!8rvO0t5|@mzNWbF8ndDCAHiANHY5Mt9kR5w(BG4aW0B+rC06x_p3Nrx5tA4EEZGM|bJ$*Y<=qxKxMUc5@aQ{R~b@#*-2~^N^S;WPp0HXoWk+z%e zVyZ#{j@>`q{_4y?e8XWH_@=SgiIkl%AF~|SxV-YNHn{^*c8&Qx zSUr!iPalztyIq16DXKrKW=o}bv|-NH)&o;#XRa7Xs88k$vo8msn|aeu`Xw&G&V(e_8sVzs&S?QJ=i()p?&Nbu+N3pIh?#*kxF?IftY~+r`q1Rye8QXhi;A(5p%WET zKl&_xM9IowbsO8!`O?!s9_Nh)41=NkOldcGrLpa-{3)Eqsx($JyS~diXQg5{IfF9# z`6)#@K($|U)|Hs;Ju%xh&GPkj-vI|yaZ7qI;qh$HM2v9=Q#A=h)`hK%>cW0W2Tf>(QUbeUlAToEFLCHKA{AOlSr@SGnORg0WzitIH|?-|^kJ?mvmxKF zg^`axl8|_R$UkR8(!1Jw+0N@PI{ka$P=7JSPEioixn@74kWYQTz7A3j@8Vl{HIEkl zCQAwuqfCtViZrSWIR2FnVxz2dCYvQzTBE@ta^`ccydD+2-L5;g(2VIHS75)s1N%o` zhIUic52&2B@6IyChOFKcOUnMmpQ7;cj5K`L=WIs2HntRp-MB%2xzfu!)VgSml{O*$ zbXsq}Ktj6QGvJbs^&Ja4ffeG8wMh zU&S$i4k4x=tFYpL$X3BKuuenZt{=8~PGf_K0^@CFep0Oqcqq;EY@ZwH8_x`F{zX^8 zcF$tqfNwo&bDSt#Hy|^%#eU+cy@Lrs48ysL(B5Z^Qzik?a@3_*F zbGBf9HykcJ*{*2>{e?Ia{-KOlUaNdfQ}dlqs_?42b4cRallKiMuhtn$2-cr7@bLTK zE{UBoi0|u#lDqAud3&^WQS5)g{Bhk>=UjC5_ZMdmi#SHPzP^ZESg-mXAKZwdHavGq zw<+vI2!C$S2$$L6kZeVM%pO~R&@2C_=4g>VABwbd?~6W+`RxvDYciLyNRA({*Z~GF zR5M?V{&b4J8rDD!aLu`OY;v;`A!IP}MaM1honq5rSjUDfp4>7V%cY+L;%a5j|9)H- zzJQ!~AUxAp(DfdIiLUi-niCNSsmt5q@EqU#3Z}FEQJ{(?awpi5R5yC&2d@6VVj)dRDq9WCj(vYzj^U%X5%=b|6Ih`_4qz`@R^^!-fdA6?LHT(B}C&RgV3E7JSKq|?DuL% zt>GMZKwqhzTsKn5FXJ73t3_!YJ~djW-4)9oymUfJE1~_LKXHoJ_}92J|9In4XGX#3 zvsEeVSNR79Lj>+STO8bLM{szKw{P<2OlaS=G%NAPDg@{WRQ29*&krVHo<9?q`Po{e zak-b!y8=O|hyEDt&HjynXmMgDx{uUH-trGNyQB0at>g)}(+Q^B(+;D*69_!oCK9`ysE1PJv-uoy z+wB$gYPXb5P(2$SO2k$mCC6t6R#*Ed;_I_sXTl58JaTN=JTh}CH#b5lHL6=VA2)X( z>yph)I%#Hi9bJwSF1i`R~ zAqZ*Nj)!*dYWDRuh7)%O(OW&!(|2GU!fXg?HCDC1%WzgQZEzeIW1URdG~5j|no+&w zi?m(-8CQ2%fI20qaMi$x4GCOd$Qml`%H)s*izM9GfsMqoXk6#ZvK9sFiv(SlT?+Uc~V za1Wrna)Cp*j~NI47R^_QKvT!v56T$l>p!SyJ zjoT2_)(M}?-PIF6C8ixsOG(sD`X2sP{#!*-bf(rrub!QAC$eTUwJ#=K9u#a}v`!p9 zpKN;Vbv0%A*v9jp@>br?@Ix8}_?VUNpB}$!6?uMltoO2Z`a)9Z6G5V8VN*_L*oE-uTy={W{7?NV%PGd+J_>yQ*FW&NY489Q2lYsg*mWDda1>GL~ z;%^URndH_ai)n@AUqZPS{LCm|rlO>rTnS{o`?=+o?%7c1Ih8XA+wKlQ6M^wzKUmh{ zl$=)FdVgx+7Jm30Ez26)5Kv_AeoH`%2$M^W_K}=AeeLZ~GR>BMy7wjB#cn|aI6XTx zQt5Y?AHrbPD)3*0`W|e1T9p7w|H|_*_V(;SEB+)IAC?EkI6z!r3+RS6!7>42#>>8> zre8YnBLcNLM{5b9sEoLW_CDA0ATp)UjFZZq>Z|PkGZo=&7xeXfUiLALDVahe6g6dH^BQZ zR^1`}abMJfkGT@nF%xF;20HMmRll))fKNa6^0fkL+t;F^-b!?)^|s$t##aJ#rW6oJw`Qupk$IhXnTVf+Ek2@r5J4 zhGVkC7tO-`LTf!s7rZPOS7-phZR@?77iT6euleZru2}gpqjsmnlDuIb(Gqr~;7^zzk1-u47vS#v#E>$fef`8_TM zr4%o}*jJ6u}K?x?y$EyT$&U^tK z$3(&+NM0dpRZ;V=aUFV_zJe&w;%=^)P53nKemr@s0*x~m6l0Y;iF=!Q4Q0_qXZ#N%!t%vVXY5bRtIK+OIgOez z#I)sKlIiU3>Yo(Q$ab`qbjWG*vX=6O;uUg-P2q>6lLvNW^=9Rf%;CC+#2QG3mGh)X zSfcWg3d>+_JaK@X_qgJ%Z`imeudCgbZh>=;txlwk!ua|- z9o{cCy>PHT(QoDLXqC1)h6?u<6j1SOJccwlesaPLtCgJ-V( z8dUZOXC6agla=l##F-}ufNHfd>Ks(CmZFZ|8I{aH06^d4+R%Jw{t+)$h5+Ooau!2| z3646Wls-Sv5S01mghHbx2|fy;PF62INDd6-bHnW^N~C%O*H0nE`w7Q??(fk6JbJ72 zLB8m@o5Rg=kK58qtL|a?#DVgQm|Fjf8f>`^vKjsm;Zs)%Kq}Rpk(V+^3_IH}>XZ*6 zE!{hig~~qAr(ia~r3cR>umj4qqPa6QwKH|gU~3h{YDW{V2B+?(G&&Zk@RLzbeGI$U zQQqP}`8HFE3fa{wDObbd#ouK=e)>R%?{D<#@HzKRx~I!iDqDKY%=7iUgSOm|=_v@N zL?5a81a!^ERYXcs->Uaa^4IQ9&rR6Qfer!yhdWO~hOQSlshsTe@+KRhyxgA>2!aph zz31DI3Mmkgt6w~w+EGsW^O(2h)+HSm+`qTvJx!3?4*(p1M57$pi^YmgC7OhTa_7^S zyq9rre)#kUHF>(JU7&vWOsc7?e-i6|*xXE=eNGerxMcb4A~u3k`hcW_aKr;HR$cnS zAA9#NxBr&q2Q5v;$R`P(0RY-L_N-yWN#Z84H_QlrHvt5AwDr4cb<{1;gN=9y(0=0g z2pxDJ{J;0|r!gEj8(;MN`EyZ^0lGh#Nd3AzS6k6zE_8FHvYyTvOr;*4B6% z*Ht+}AL<>!rSDwJpoFPVhaKETdz|BaNj+y-8ov3MrQv-%9Vo1NW!&i}{N!vKPh$B{ zdC8_&&G2zYqeKwv6p;B{1xl2`DpCcKK@GShw7>hU*>+;Jx}v_PxIgYSPh9tRilPUU zY_xy2#tunOsje{Z^7gN4$hJwFI!$${t`emVXw`Kaf^BDEqz9pH&oE^x?Hu4zA0(mz zgIvHgUG*K*s2*(%gPTnv;xXd|-ti##!BMa9DhszPjj*aJj;Hhc0n=>1>s{vw6>&T` z9b0K4UEc7L9s zE7Y=h@Zi8$U}KNEA2BujsbA&D9VCGA1l*PRO5_BMmZsGL@qiLvi_rSlq^4H(S*ST*0tVA!cx^&oEqx(^#oe`ug>cT~vI zy6p%-q4;VmvaPS{q)8fx3+JEJPfqDt{&qNA z#3L)(1vSsRpM1BvqAwBD2ev2@UqJXKTiMem$SS$r(;f(llCl=|zzvUUhYiTlw5lcr#6PfTfX2X?d{`lo*I4|d6Qi2ZZeAr!XyzevGZtcJ$_@n!UULKe%? z|JKF5hLcC96F^CjJxyl0czYcu0Km07*HEFl|UyDzTH7gZvFJ<26s$3C-M2; zNnqN3|KDo(>60QTnLE1o`&ZTRNNHE!DSmr@mtq22rfj=(%&;6Z|4It6tRH?NKb+tx z0rAF8vpmV=X&cR?47XBd;EPdhNt@OF{Q!Q2Jw~YOA8bv%)bJ1{CPsR}>2vcu38MO# zE0ruuzn8EoTe^I>nX82hNuCkd?Y8__FC5#2I0mqPx@V~bGPpF{0=ds(K`c@D^l`6= zr%zb)PN<{vqlNr^5J71Lb~nqsw=z=$Vlyx3p@vUJXWES0aGWnr_u~`b!%$n^G%DQ2 zpC=mlRi0*Nh^4Nz%_z<1+%vUD+WX>Lr6x_xs_Rc8L6zP$WN0V}@$Q~ruaP!4CKYvY zHv|e@!#Dwj!798=c_6}{7XPMl?Bi)_6Z#f4bkqVOV2pCb`}N+GVzPZ+M)VyI+@eDZ z!!R_TZOKaKV{6h>I#aHNMr~JP#T$SLFAD&_7Z$h>(J|&tEIem+s0XLD zxHP|z9Qplq-O==_rtfLe@gj>No#_P$NdJZpnirGI1!sbM(n}hhwJENcv_QQ4r*ZsI zYa5s&SZ{Rg;Pz!gKIhuVkJ#$KMs+G;RDoqFiXh-Fgw3sQDsmGc`axGQzC53+I7aZ= zKa<25ASki1PN%2ZSZYg^SQ-p<6r^Wb@%%V+odP8{Dhe6TJteA z;DV?Y_M3iHx0uoMKNSf|^rgitL!Y%3U22^`JzFJI5cR@!s6k?nni`L4v_7L<$aX2t!(N7T0!pd#Ve zZq2yH`7!MYgpIr^zDY`uYWk?LaZGg{sP+s1;Mx-;qi5IsoA@3^m6)B?IR4h|)-9&d z1@KRp0O_D~ZR+Z4QJi-_p&_E;tW%CUDcScTXp&~XPl=lw6FchC_e4xM8_S$AHi%A7Pq;_fOP-rogdp2 zx;TJ%=#lPk5fpHc8Rhd0RzT;T6YX10ED;m?5lIfGW3HvY8l|5WkhWD)ihFQ3-5;_!xa~)AL3z|ox)u`P;A3CC|X1(0eeB?Cg z1mM%5J*%rR&*3w`YjL_PNEzM15e7N(d8db?k>~O4@sgg8U9S*AVn@JR`p=7yVv{yC z#dfqBM{YUfLF&sdQ80nmDA5)|)czUEnwsIong&qV=n~Idg+bp3uxXG@RKTb+N$865 z`D-2nhXpE!cY6H2okq2SX0tz3UlbHPuv;I1!Hj_+S&M2me+ajOa%^NCsu{$6ytQ5) zT2_bqxycSV`MVMC(xuoh=xf%M&~tC=^|;&E0qTIg*0bBUIj_MXhpVBs0y42&fCu|n z(#ZMg({Rarnn+Dy4}f;QgmCi3B_qI>eS1F2p4t1?KE*zs@GX3}8T+}2ShL%%dm>Z! zM3R@~>G1^Jxc=u<3Ub*8cy#meP~PSLA71BfKZn?N&u4wzr5)e2F53|)8o8daSXwIC z%s}TbffjMQV6tL3#G8BFS|q$vjcpqD!{W$+RW?+{;orWEw>jKUh?Q)GU3EGG5H*vm zq`dZOGe0AW5K`$@Jt@{=*Wt77%e&A2Ao0c@=#6aPhTaHTqHApW)w5Wwsq@%6`7TP6 z`D`m6*xOAkf&2$67kwhnKBy?fYYk zA+lsboi_>nMLTZ{RVKY|PFiPmtE8Op$RtC=kiZ2kRK>`Tfp>&0NyJrOPB%`%no*ls zG`i}_VIRl8W*iwJXlx6ulw@QtbI^h!Lq)1k4iDksG$00CmtBhXHt`D0@=H>54t)V# z#Q89#LsqeVW-k}k{Rf<_3zc@vtB(D?Efh*80>k? zx@wxPaW|*$aB*|__?MBk+nllehfX=lt@5wGC-W@&(HD~Ix_!Xi5*TNx%HGHjWS#sE zeweE_mOKR{<#jGQc+{Tg-1$lJf4FXEB{2_ty0JYR)-?&QiJzyXq)yf0NxwD#8Zo!N z^8AC^&FN&94)F0-1*hZdHK^O?@$Eo@x1(-=t=SM?r~bK{kg~vtg)b@lPm>Ck#M@kk zHrL~e-<1#wDUOe^PDgG(2C5|FZiIDLopvA%|14~ruaV@}PtMi6gY}}Uy<(cUCzMX{ zE^tDI%GANAXi4%rw4k4`PQxzdDADsU9Oj zNB5<{iL#iv5RW{NRpS}edmgn6J$nNr&r;`AIJ;QZ710)@=C}%g--UqF}+=f!c?co@{6#uFACp>&u;0W%W z_nMV~U0xP+yT}dis~^rPUct52=Dfe%Az#j z+F{}iS2dKhKb5_Zt5Zj>JY1b=@U1dhPSeg>n$L~beg}q*bXkxQ!v+^ft4Lxa*{_j= z1&WYRqCjF)Zg{Fbzlrn^A3a#_6nmz3z`+(#`Vg$$&znp7oRR}S!L{X3{$dPQCQ5Er z%_jWCs&`{C*2yCtd}b)w;D+^U7do5kcREH+(Dxn5;+&lviPl+UZS08MhTO9_8|ssB zU^4(e0ERR3sVl6|Ij-2;9{l)&q!2y?crV_%Qfg4~xI`86CjN^1N*D(NoH7%058!x! zg%2xj!Du3;e6hT?FvFG>(!ldoJm5$~{t)CuU7TKl;QpBTI8dF7nuSb_*;*uTg2M%w z?GF93=dPUUJU6Ys`ceR}dVnRGUvO_EwC;&p84O-8ftfXsGd9aH8Hg;XXztsskZ+Wh zal*{+y$n9!KGgueVg@{m71LX)3Q?;*26&&W1MlO{p67L`JC*JSQmAlD;qbVV zb)MjJ>y>aZ-5tJtc8?MNJS13A0UQpKRh*(!azBPm4?T}AQu%s4qTAoV;a!vG!H*|h z-2&&o@m#H9Wps-^d0G9XpF%DuyWYifXu`}#P02C3nCs>yPm~MHRXh3Dsl$PYb6?vR zhgppW&m&Lju?wVrYU8wFrKoLxyYT-AR`%_khO9?t5B=`({@+J5{{w>}C3oEEImJ2K z^BxgyJS+hIcahZpz`p+$nvrii7fBqwMGc|rw!!Wb3wLWLrlB>zx}53DFNe`u0aK8g z_4Gq@xHpMc%=JUVl;W8`QO{kJmx1cZ7D0KhImG5OpwHz1{f7E=2u!RF`o6;)KJIMU z%W1O3{1ch6@_1aiMKYb2;-q8$vN2rFP!xq5}z;J0i~u!%Q9YQh|(Ze;Lu=R-}tjEDPs zS5gVWbHX#nZ= zV(YzkO}N_FqQ5pteeWw8ouk6e)g-wTh^JpFD$XrrIsGE`?Ma8tvNig7pD!pTTA}oR9b&$}Y6#tD!xT?pQ45yRX8U!`{2-?Zw>&& z@^ekZJfBdL7+gQ?qNmm~cl3|N;#UxD;^S`iGb^J>wM5*{?Bn_SrUnu663?by*^OIA zADQ^C8?%GWIPnTqxWbd%O{~rTfdUuq6+e2`lrq{9@%lo*FXRCBtABGh7QAZ%TTIiQLdk3G$yj2GJxtTV2VkEC^q2)skxuyTrf3Ef64uuSZ3XnEiTyki#a>qzEaIY zy=QK&tau1gx0ma>O3JE5p@YKdz*4K@L~*y!Jq{WfY`C}#$2#FGuX~?VnsW3_wg*bT zT}z6xN`N$Q4c~tDG3l<@=bHMlt=F<*B(J4%>R;RGAg+EZvrt1*uXCkCy`FxWq2!98 z$&eO%nrU_ag41!o?J{!Q{3%q!-#DqD;9UTMOFu6kBnprNOT%O64(`3FC~8kTZduyM z>E(H(QmSE3!zt}WyY>p+{<=zAr|vEv8)sU$tsBt&{!{8h!-y*$N- z+T)Un81ht0<&bdR{4=GG(4?%W`4Iu)PkLQXS-FNO2{~`eWKt7BdT0e!GT!C49DIF6 zy$4$A-@m0STP<1%MJlYG!*(;E%MG!*_^wZkYV001srI0C|Hy15tnKS<0>1-pZ+(fcBq?Xq>AH!s47n#8hU*pL6`T&L}7d;r|FI{t9R> z`~D9WtHnL1Yev3085dBu|Icx66dV1kwdKChAF=s&bj+m*lYBtzz~5C-VS?20IPq`i zvr+7;UklTp+J6V!dvayA0r$V{_7B)39%@|qyP^1Re+&5k)n5IFpC0~)+X=qw-({Qs Xc|rCwzU=0ny)-d2H>l9N{p5cEHx&?2 literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials-organizational.png new file mode 100644 index 0000000000000000000000000000000000000000..054470d70e278ccc4ae39951dc33cdf1128df43e GIT binary patch literal 14222 zcmd6OcTkgEw{PqUA|fCtAOb2P0s=y$E4?GVC%#na0)`R@AgCa{N2Q7M8UaaY0UJfS zp#+Eo5d(x?5=uhC4SK$E&Ufa_ckdr}4l~T`C(qh-mA%$)t>?vkLoF7ji%b9jfJH}J z-2?zQj0OM>T{wB1@yqLbIgAIuA%7DsRX}w=FOl(Z)b*ahJpiC4iFxm@V~pohkF>4* z0e~}~5B?8z`jk2W06-xf^?PPPpyiy^Bwnqsyj5_QXj>yNY{oJSh1iLdIC=I;@-gl- zHX)PzkH@|!;EjdZ)l0KaZbomN!#`ga^JWVYsB-+ogIT9M3W$u@XiLj zt@5P6)3d54U;W}HPNGAA0^%Gp?!#W)%paZ z@jnnne4UY?|CCrVS}siYz4xbM#8*|Ptwr#D6J=9n-@m!|g=d-+Iz|GcS9^vrnEs`r z;f^n;A*A7D^p!;b;PK4XQo4NYUaS4#2)mfCUTvR5f4{if_T8e+)bU0X%5`Ko#hFmQ zM018XEyQeOiO!v^_K@-;%6R3CR87jCRP+SeeVvS5W73xRDi0XsUzOlD)^c$jNx3iH z85z?XdonszTvI!MmS1ExZdra`)HDB%bLkxnL`&JsMlX}pL}ozt zhI#emCwzp~W!{QAoNW>~3d@6Y_n@b~9g0wXq^Ygudy~-3IpMtNKSws_>@Rf*HIwqv zjhqr6*IKx_&lx#$+*I(pW6wZt;YBvDl#T~DYLCrbLi8hk9}<$oBz&C9Zae56e}fmW z(|3y{k!RI3;%gBHXctRsUS5^cbM`$nCj1Vx$}58|KfHz z5jb_`@J%!7(K(NYK2hmj)k$zfk1Q%=?h?tj4xH`pMkwlDws5hePXQ4s zhWE6u00x=8Oy;^>C7EpF%;f@6n-rHEWtYcw#-&wC=h^OBcCoZ8Pe*^#r%8%nW3E#+ zALDvndx6Fs41F3vh)3#3AW+?AnVf&!hg4 zGZg<7eW;Qj_Qz#V!`=Gww{j!O@&V5(p*EX#-a)}GAkKA^f zP#CIpO%uvrW(f|p5u2=wJCp>187oa9eS7xQ#g-=X4a2tQ0)h|ke2tuFo+*4?XnIlQ zIArQF+9)nWs^3S zdk`&@M4M4u9(~rMIJC3u3|f0NskJJ1KT3NXN&ft6hLc<*QB|6>{C1$zouCIc5nWF( ziilpwQ3xDXU|s%sWo?ZQGS{y_>2(hyEzgaVO8EQiX~U?yD%>+%llLZp+NZoA18rv-ngfrQLEQ?IL2l`g?AlLE(ER&mJ!O!flP3`>)oLcl5vHEpjxDPy? z0^g^blbOYu#FO@?`A1Blu&?0#Wr^YG{WVxK$492cSuND?C;#Y?Rv2}-RViec&XqZ0 zOF-DG>?O)OkFJ_21Q>8RZ{?UwH4fF%)y8!|L4;Fbrm)8z_ml#ykjth+O)F8}lUG@% zOhma7%ZY9xD6Qpje|;KArc2PDKd{_1{9GP&XKj|a#r7&1I6^Fer=uX7rjS+5v0_fh zYR#ngd=+i-*;+o-gAge%Z%-P!WIs?tIm&z~{0%5ep_qENTYoV;sf-!BDuS?n-nkHk zU65VQ8l^$ji9PK}49t9_e*aj#-PF4Ug_2mZLg11VM5ocTJ;6E|gWY&rrC@T2$G>I^GLI%)l9c2PKM`P_MsDZiPpn9temg&APKI-2tH(1;=@ zZA|{Y3i48G5zg;@L%;@a?cCVvZc_8fti0;QPFOJC^2|@vN-3rKWPeSIh3MkK(3@A& zXwOSrT3o}6#cvc7$!O<9(_zWL#exnQ(eak%vAyNwR#ywS#F)INEf>h=eE~G|(tB7w zl{){7la@WLjnMD(qx5S%ZEn?qhP3+igY)Kcm9%X8>o)yk?(qlOVTP%mn>V z(PCSCfZMk$X;6>a!)4cec6!D`c$ln_6)X(RI`z_WU`eIIyJfr4H2P$h1{&1%tp@&= zDYnscN|9dHwYz*@`Xh_DvuN4=&TDx|r3!Dk0fD@>?R!1E)X2U-L|NKEwpq^#WYCN9 z3!T(L)$CvIBuAMe&R<9)(?geWb7z^CpCYM=32ee z2`i<-+T_nGdaGFHSc2tb3$}uj+O*ug@`Jy3ZhvZhrTAPBJ%^PYj>?#HCp?kb@8~{@ zG16>ryELf1IxJ3eGF6GQ4y)Fb}WrVvZ4|lkHV8!?menhB918dgYpdL6YU^U3beg*2-J-;jtexS}_bhEsjot|~r zh(kt_m=jCRc<+S}8chO?q^`EDmnR1p$&tMmfWisDqcR)MD=7vq;_)kfl)FM+$~6t8 zhS?3X2_Nve5Y2GNtC9(ywUh1WpvEDCzto!uynT@Dt=aV+m;`K*3m&jC2%8Aq+?=0v zt4BzNRuOmd#{eQBR$z(dhsr8%s3J&&VnCprgK*oaF`nR+)Va*+DQ-4c>uVD&@ittk z#GZkAw|~rc_UWwb!xx@aue!-auk~5!_)1`D;z{eo%+?gyCYZF_>3dLT_b9$;u}T!) z1y0C29Dar2O^#cc&MiYz<`e2UrJX-bURy*{oS%*li+GLQ_Ykf147l$xH%S>vw7rd$ zuoTa7gg1CyKGIj3+}Nl>aii6y-7eYAS@DMk&IhhYj?M<|ZWQ)xT|@J!udTeD2&5Ee zWHU_0T{zc=>qZ+M-JiC$Fk!^VGtM%C(KTF!hsCZ|dj`kc&w%s{P+zyXoS8R(mb|~) zVUuwUt@%#%-dO?v;`HzK-%AXqmi7c&WmjXXlDc$Y;lzODhKD5&j(%?}4cGyCszXhw zHbQf=Oa>=ZpGdteojM&8(>!-6*Hs_tDrkD$skLYjjY3v z#0~Yw+ZhD|(@NJcL8?`uH*5WEMoP|+3gQg|f*ohr6vG@ID{C3dNOHHVzthgUG@67y zz6!F47Gh1uw-)P9IVM(C^>r3UTgm#A`B#s<0!poLTuum{$=J|T+6t8^_=)Q0lrdF0 zW0I@p^g)Qu!+Y=2fCftAxTalUcur?tOYWCEkK2Du>2pWH@t;mFZ^Wv!f1Gd@NvyT% zr^;mU20wm=Jlm^k*R%UcgD;Hsj8_k)@k;jrRk7MLPS58N$m!t)&JD5C5_>B=O0ba6 z#QpF4C}3CIv(>X`U7u)SNomSl{Nd2Yra6;sV3_mt^QO7ICZv$<&TFY%b9^3cT67_6 zDm4G~9Lhs$M=%vn_r_Eh-Jeu!1~2b-M>hEm&>+>Cp!Dpg+g28`t#w>ZTf z3m%;Nt@C|g_4$4w`XG`rKWkkdzHd4FDIugUIPZ}CGYkK@pNVJYO4+Q9f==t^X(n+t zx7rtOt_uf_Y{T2CT7y^Q6np}bCak~Oph70OoCG+Qb`&2?R*ETs8*ex?+WLi_eqav=li^tEHNBn) zP7R~S8XQqz*J#-58|Y=M)f%spKpA&P66@+imwbW z6GQz3?^Lx>NDq+}f*Q~?s?AUu>3kBL-S2b5+fwT+6^F2#rG#{wPs#=vAQ7&-;{r#q zjU_}DRoE(`569*amANZqV(63iEfQ14%0FeQr?oc)2>RYQw)esA?&=WF&u!NxQozpg zeOvzHZJF@h&ti4$v0>gZIsUz4KGjfYt9zQ}wr}zVub}gpim~{!{BkZm=}h;klZFC< zFU?o^T#Npw>vO&SnqZ2>UE3nmS>3>_7`Mjn#?Y#UY9gdQxmed{du9~Jl)qhwvf+=F zzF?-A(2L7pvwPKac@r}CpMp~TCp!snFp$uMDIjU8?6BEO7{#o!T5uSV_&{fmi5VFM zpV%he0Rvx}E(mNY4@|nh*J*t_A3>eYyM$v%oYzBtgI|P78N8Kg%n7 z@ejJ?I+g@<7NWew-}F*%DmPs7xA+X?nT@(_V<;bXC^Fq`H#yEI3A6Y$I~kAdqcmME z2%sqX3=9NqYpze%+qx6fZ-tuq$|e4<7ok@;jwDKKHrhe1<~ILXGUjQ}5LB zgPQB#8om!Rx9>w2mDmilx42D)*i0_%xs{*ccM5S@k=u{*Tn~}6h6?$N={mhvl$Ee* z759x6^4Mtk6<(p55PGLq%vLbTk{BLrI=s_oZZu#ig2~!q9Q@V-ket(fa<-1CrgbEw zd(UM%%9BRwE4+1|D8?(>iq|d{YP^Q8jVbpk8Wb$^>hazM6{3cG^}dM>y4&XDH7kep zJKef)!l^s5cLaR^9=xXAklwY-Bz*SZE4kf35=3tZ8YifGmiKL3kZc0wJ~b*IA9o#& zTfyQL>FQPeDg|2ua^R57Y1ZKk>>i?HclzpfMaQRA;_@xQg7vxdZrt+o=g)+lm-n{d)fY1~kae@iKNZ!cg=5bdX8Mk|-7 zrAAtX#&x`H`lVy?BDCt;dwK3K4NS@6!l+HK!Hl!h8A3uMbAO(SH?rcbK$#!QBGsv` z!(s|!yM^5=-!!)%SUNu2 zuFc-is1FbSCEDYiZB9)R1FA$^Gbvil7bpJ%S{o7eBG@s1=g7ICp#hwVs=${~obX??!(@u+Kp8D$ ztCSK)nA!kU4i_{pOdO;AL{{uY7+ZDh=YlQ}Ub@jXk>k&pyxUtrqpZ-%Z`_ zIzj!#Dt%M2YF_xwV|=qDZV3NB`CeoPBFZ&>&Q$$u`jrM z>NZv#zw!V4GS13I^Tkv|?8uv||RM4)FtZ-!6u}e*S2#Mis#L6O9 z{MiMnB!@M1=Vq>SVdZ;NQRTg-wkp8)`r8Y{-EQ$+^-I#H1_UV2Md%T6rn6(uoa+}_ zb=a2p&)--Po$UBLPO@zjyP+dI)``%7n&u!X!zt0^)imG!j31pS&i5F$Rj_xPD zm=BQBdBP#Dbjs(M@UDz=4!0Rqm~(fcaZ7FxFr)7SHa%{Xiv%7``>3vih+kvUml#ui z!g2gc0>k&J#ovX7eC+*d@N(|dt$-`xK=IRO3gO8$EQQIo{V9Q_kXnwLIX5=MR2*`O3yw{ZgFktut96J77pc7C+P7Qhp@PPV+ zfk#W5l!I#!<&Bf{$A?ntn{vp=`#)`p3^h}8HYnY#J({=vs0OlL#C+?v>EU zCD=j;t6A3IBW%^?;BTMV9z)s_kcpi>ZguzyaRe6Zwa8DTQtr;qHC55;8Ap5eH^8VT zsVfh}a#;JcmPzm5wuahQ&c8OXIIl!Jo#YHWf6j{OO_!6WI_k5wj}@vY6R&z7jl9!S z)#>BqFE9-W=O7E~_&oYv4Pzwla17=%_Uibwhu_+6}eO30ti1vJQW3IK0dknpzjrhTfs_uMMd-)}DxbvY>m`7IBrYu?5 z&}WU+3C=#i0stV7{h2@ge%wjWq+uXMO(3A1G8_7XNvH|={kt8NF-GQyTYQ(zC&D=) z;_RJ|nxZut=z2vcxuJ7(**z?|YRCHFq*2Mjk=2)ISaQ`{8%+jl-?+TNG;iE3J0ZH# zwCV08WEIFjyGl>EUqyY<5Mmqx~p2QH}vS zpNVIa`gHLEnUNXgK5<+WE!fE8vCv|#+=k4Ty`;D{Dx(z@!h&heIa2T?r(D3d#FufD z@mx_EAZh2n)T(kMGA%E44XiYYs~|XpK1V9Z-`udPtwGM}A@~f$MV?KhExPM!)Z8S$ z^1`>qJU;U~4f)pxjBS^TKqWcG^XePC_M_|QCI~^+(!_c0u2qGzX?3NVVCT)uzUy_I zuA6nr76Kp1z9{7d{pWwun#aY_BiZ(B7{3+o#_Bz6dO|$OV#7wlvY^(Pwn92?p9ch6 zm84GUzAF;9Z@p2mjqYUR(|YZ#BB$9)&v#Ew1gMYXhZ_|DgQHGN8I2csTdh6qnsxFJy z&WSZs&*cpoug!2XPA7un`DL_)KA&+$j2UI|ToLL!7PE6XtJ!$wMMcWbHuuCoVfkCbj5{_D@eD*>&HRmnvj7>vh)=eX0_b##_O8RPmLJ;+bYt6#Zw zEiNr}Z1*q#@QY!EYx@UZXg|9{F}(+%~j=){&-ZXDU1uUKCUZJJ@Hm(zZm3FWElFvrZu*9jeHshY6h6G`i( zTvczq{Hj8fKpmErg4eYp(_Q8DR`c7*?lj8J3x$k%kTU-u*H4J2T$Iyb=p^7c(?8C| zbSN3Lc@L=NO{PGhM=*>z1||N{$uof}AfqE!ZmZ+7?q6@OcT?z~GQsx5KaSeyrr-x# zIvr2{7hXB+*YH1L){4|h{}*NmU;UTUH2l{MW~YDouZML<w28Y7r^*l*G@NgrPMz(9HvgvV;T~NUL#TGMyn|faFj2ivkHxPLncmPTi_~9TUN> z{LLn&>G0bA;gcz@&FFm*cBgZHD9;vRFX=qwBR~p~w`R7MdsnX-GDZNHa4%^4NUGW< z^}d#C4`mfUC00qAel7Q`ey`pfioq*E+{zWYrsKa!(ApJ9%9BJ zoGz#j3Wge#8{4}UqN;9=XEIm}(EjTr#v{q;)0M&Aq%k+4+tVQHm?ffn^>y8So?s0On#`Eul4n!(UghQ@0NnrUpk`wdJ233(- zdH2IoaByesay5Fv-NWolBzIfjCXpz69s}EO*?wtXTal^_ z1a@?GH*>Lkrbn}R-yLGOLO$6)vdGme?x|Pb`WbSg=T0r3LSjgg?)VgI=4w_z0}T-# zun;&fS+&12Qt>g&8BK3wUiaW5Y5^j|fBQd~lxL{0z6{6;GfL=~MRqK|?Uq|iTKhP* zQwg-b=_}e)EG{bZ>`nurdnTG1omyOT&a@hi)Ov<-E8ravGtEH+ULx1n_B7MDeyp0t zn3_XyjZYhvPxTMogqw`HWepABA&^mO157;bS!w2+Lv=<~VHNlj`T1JVN~8JFPUQRT z@JEIh!^hFe7NAAGD0&5=Ku)WfR|yVi)A#lIycJNvkc|UHSA6uWr*$o)Ce>I+d;RS) zoOoGU)$9RNIZPe;_|-@wCCJ(S;MNwp=aqW?QgfA9KQtwIZ7+64F4YMqdL@H(t^aFT z#oPLUNP1vcIYg}V9d`kZzJ*KwcBs{3BXe{38dYMK#As=x!M?@Y`7eKlktq9RcIkhTOs@zigR z^7;AG+ZuMDbmr-^`EI-B6+%~MkKs`fheg=aS`t-FPmX@i7UH)lw>zbs3K}=scAL31 zU4xtWSqY?lyCxuby{W3Y;XT}^+xSJe;a|A8#X-;F^osUw1@AFN5MC>GR=muAr99iQ zazvGZSS@Mkjj+~&<8F79;l2^?7^ynQO>F%B8w%Cl8dfV8AuB z9D-F_!`zR_5KMo$XC><%wSN*1MR&_jhLvYdF0z9}!^f+pXqRml8yn29qe>R`U{cso zz{%gWUqKGsHC`zthB#H#7tgMd*Z}bW#y!gyA>6^93cB#klgIh_VaiE>=AnaXl@IKW z6&PDOlQKj-NWs{^=v{si;K9)YdH8KE|5Is8f9Xzv3Pniuq=1v>;mJRB6^b7LfDa8H zJWMVgSfheSVTMn{%@t&zd*pY4!`e}X*v}kB=(znBF{a!H0KfygA2K4p;~L|S?57$2 zC3DNQqTeygjiAUwfC%3w*uvYtB|(GA-dp|}r&O}9BLB;%g%ZBzF6!09Fp;c_Jj&aM zOL=>3Kb`6B*8JGAXqA-gBYsu8?Ck*b6H@V?;V5Y!wyv4-FeO%a9zf8r6S45xwM z;M|>uuYIm`#Jotwe`|9)%J4&gf7T;ejS-Dpq$cq?e!6m)NPcyNI5PL?x`bz7E1ir0 zVp#r0_stxtq3+4U%+I#_ctUxb`mvV7eZ`iUp;99F}y3S>kUamjvGg*X!oy9~2J0x_0)kPh#@1B4v(bC*_B0P+uP5< zz{E0<{*ZciMA;BAykz|ONMjfJ_&XM&M$oapuiY97!F5~u2R}hvxy;e^NNx;!6Sr&; zsdzZ$MF!i2Q-Pw7lDw{Vd$=}&$2uY(qCc*Cd}F>c@H6gBo9C5s0i%Gg3af8mhCGF5 zP+@8wJWw)=}6)2OK-Hx!60Y(NOBG9Um4coen|? zu0oH_jksk6+TmpFTe)Fkqk4H9(W$l0;p!)GPV=Gqt4*(J4f(aI9dY@G-bicvTs)G2 z&p4s0WaW#^vGm~i*tF^4uBLQf)clo8|6&d!?9xKD*S+;Pom3^n;urkR#A}hp?Zhi} z3NZq-3?`UEWU^cK0P+*<_UHxO!2epZNeO8RGtXq)6y-wz`&@`^*g6 zxPI5w(IAI)w7E02y%tmm9EgwosDltSs9o|#rKiqls|nm{pN%Yz*M4PF_}x**+R`tU z0JR-|zV@Bz#y9C&4mK_~S6r|eW(JiHBxYJ|wQs!_C7J%f_n5>QmMV42vY(_$vPvXyCT3BM&L8vxuJYdADaAW6P?D%;mWL-RI z_LcFsJd%w-GE%|hz66)^oVwuBuDSSMPE~e3i<@7roRu4&jnRHG48{s{io|kANtLwM zC~Df7E%-~mH611JmdNvGB`yOY@Wt2}cqiG(cqqNZigu4bXwDX%fcmCnBw!_uTh%Qy z)v|4-IlCEMhIwZlIrW%20uC6^!_L8y`<6{}YL(;O3oms-E!~n#5h9}))@wD3r8B&B z!IP1jDCb=O&xg^w42D#aUK3B(2gy3$<`{CYQN4$5J&WO#mU;VT=cyLR90l#m*l?>!@EAk~^m>_)Cq%auGmcs82^k5jIElvZ`&D`}AvQGw__9 z50EO4Q`c5Iwe@S{g)riycAW&8zUT0py)~(Lv9xB=d7*?Lc7Ug4GX6Fr_|AA38W248 znQ=j?99*jQj9Z$15H!p)>P0tL8I8MKjO#A^;9b+8F;s=RB(2(UqlU`C_~8u?quc+g zwpt1v2+uWd4qUC?Si)p|^NaeL-Fw1#6uFP4L#8gN0bp>SAM9KMm3nGN7+L={6 zJ!*dHp=3^hF{AeLK4{XJx|y(`D1_~-@;LcovV<`$V3NC(6mSt;iQ@FLhKpvZS;xJ| zuniY@S!AcnS9HHaE5jBy`=V-iDBXJ3dTYDbs|)Ej-u-ag#myGw2wAAOk)Pb;Rrlgj zPdbG9fyj^QudNJ>Z&LQ}cbKQ8G$J0lN*J%&i2IUa~3oZ`~=zw*B!0fz#aC9 z+6dmy9&iishx*N?1ULijTQCpecI$3)xsL`}#@$FhK z?Y}R-k`&9`ex;ZFTR_cCQ|8Kah|^Hopc#>+{ax~)JJ@J8_dN;8Uts_xC@zp8A)hv7 z+}Mp_p$F&(04dGj2VaV`&&3GNHXA0jQ!HOBez~JK6*v9uM~5fVNKGp6^(0}bmr|HT zcpa{rU_ta!v9N<4(aD5%Z#Af#An=f1hWQWRytJY>S=&eL&!GOX}G!Y zF$WPzRo5Pm8b6gT7j>+62(idU+_Vtr8C|9Z_rF1HdS9|xllEt_Q%H)(EI;?5^tYyRPxoN!@ceI(zg%>0)XQ^rOjyiaRDQJG`& zH^;00elX$03^v`s_bHx>elmth`SK`L`o8XqNNW10h2;v~ zrs5}?1KCsU8Qy!#e;HFA0Jw$!^5va>YiYlsL0Op;HQXA_Ck7mAp(TLLUBQVyi|Ju8 zFaGkewv3C;R?df2BRu01ca1}hex(YQLyPZKNJp}bOa z_g&X_WR#e~t>KVo_p=}e2xPh%BbQ|GXXAe$~jk6(5<+JL`S@a|dsc~b#h<4m%q zQxw~bZgIkC?75Il4~+}sAm&H**qtO&Y-wiXgoq8O>ODxM;Mi6#*#UiiOsyXZ&MoqG zef@Nzu!yljuxRV8c{s z)GK3EAM|Pan1fcsH47~@A4dg$5d31O@+yV_D?W|C_J=FCF1>O%n>RqcQUv7v=9RY0 zKzz9K6Z+>Mn!c09xZFb2#1uG*bWSRgAwWUw?4L(p?joxr+}Y@_Gi_4F72 z;I5(1prlYO{UHONwRzy2j?L*9^esdsyM{y6dQSXG2B~VYGsMWp!C_2NQ@;mXh81el zeB49MnBTgNrnn+V38v#=g~>vS;7KMU)@XG!tEe-hTijL4Jm-P3`X82TNsIW61xARau3 zL=6tanRb?;DgC8?K9q`Bzji>ukkIKXu4aD%-`_{^&${$~|7F#G>kk|RwG6}YfA@{n q|EiHn3*n59&;*_)f9->h?4P*V_{nzX>&4K6P3dSDs#mK%i2Oe-_>=tr literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md index 05a565f9f6..8c862f8208 100644 --- a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md @@ -201,7 +201,7 @@ In general, if you know of a specific threat name, CVE, or KB, you can identify ## Related topic -- [**Beta** Create custom Power BI reports](run-advanced-query-sample-power-bi.md) +- [**Beta** Create custom Power BI reports](run-advanced-query-sample-power-bi-app-token.md) diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md similarity index 91% rename from windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi.md rename to windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md index d3abe10318..390baca350 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md @@ -19,7 +19,9 @@ Run advanced queries and show results in Microsoft Power BI. Please read about [ In this section we share Power BI query sample to run a query using application token. ->**Prerequisite**: You first need to [create an app](exposed-apis-intro.md). +If you want to use user token instead please refer to [this](run-advanced-query-sample-power-bi-user-token.md) tutorial. + +>**Prerequisite**: You first need to [create an app](exposed-apis-create-app-webapp). ## Run a query @@ -33,7 +35,7 @@ In this section we share Power BI query sample to run a query using application ![Image of open advanced editor](images/power-bi-open-advanced-editor.png) -- Copy the below and paste it in the editor, after you update the values of _TenantId, _AppId, _AppSecret, _Query +- Copy the below and paste it in the editor, after you update the values of TenantId, AppId, AppSecret, Query ``` let @@ -108,7 +110,7 @@ In this section we share Power BI query sample to run a query using application - Select **Anonymous** and click **Connect** - ![Image of set credentials](images/power-bi-set-credentials.png) + ![Image of set credentials](images/power-bi-set-credentials-anonymous.png) - Repeat the previous step for the second URL @@ -125,6 +127,7 @@ In this section we share Power BI query sample to run a query using application ![Image of query results](images/power-bi-query-results.png) ## Related topic +- [Create custom Power BI reports with user authentication](run-advanced-query-sample-power-bi-user-token.md) - [Windows Defender ATP APIs](exposed-apis-intro.md) - [Advanced Hunting API](run-advanced-query-api.md) - [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md new file mode 100644 index 0000000000..d4ceebb3fa --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md @@ -0,0 +1,112 @@ +--- +title: Advanced Hunting API +description: Use this API to run advanced queries +keywords: apis, supported apis, advanced hunting, query +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 30/07/2018 +--- + +# Create custom reports using Power BI + +Run advanced queries and show results in Microsoft Power BI. Please read about [Advanced Hunting API](run-advanced-query-api.md) before. + +In this section we share Power BI query sample to run a query using user token. + +If you want to use application token instead please refer to [this](run-advanced-query-sample-power-bi-app-token.md) tutorial. + +>**Prerequisite**: You first need to [create an app](exposed-apis-create-app-nativeapp). + +## Run a query + +- Open Microsoft Power BI + +- Click **Get Data** > **Blank Query** + + ![Image of create blank query](images/power-bi-create-blank-query.png) + +- Click **Advanced Editor** + + ![Image of open advanced editor](images/power-bi-open-advanced-editor.png) + +- Copy the below and paste it in the editor, after you update the values of Query + + ``` + let + + Query = "MachineInfo | where EventTime > ago(7d) | summarize EventCount=count(), LastSeen=max(EventTime) by MachineId", + + AdvancedHuntingUrl = "https://api.securitycenter.windows.com/advancedqueries/query", + + Response = Json.Document(Web.Contents( + AdvancedHuntingUrl, + [ + Query=[#"queryText"=Query] + ] + )), + + TypeMap = #table( + { "Type", "PowerBiType" }, + { + { "Double", Double.Type }, + { "Int64", Int64.Type }, + { "Int32", Int32.Type }, + { "Int16", Int16.Type }, + { "UInt64", Number.Type }, + { "UInt32", Number.Type }, + { "UInt16", Number.Type }, + { "Byte", Byte.Type }, + { "Single", Single.Type }, + { "Decimal", Decimal.Type }, + { "TimeSpan", Duration.Type }, + { "DateTime", DateTimeZone.Type }, + { "String", Text.Type }, + { "Boolean", Logical.Type }, + { "SByte", Logical.Type }, + { "Guid", Text.Type } + }), + + Schema = Table.FromRecords(Response[Schema]), + TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}), + Results = Response[Results], + Rows = Table.FromRecords(Results, Schema[Name]), + Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}})) + + in Table + + ``` + +- Click **Done** + + ![Image of create advanced query](images/power-bi-create-advanced-query.png) + +- Click **Edit Credentials** + + ![Image of edit credentials](images/power-bi-edit-credentials.png) + +- Select **Organizational account** > **Sign in** + + ![Image of set credentials](images/power-bi-set-credentials-organizational.png) + +- Enter your credentials and wait to be signed in + +- Click **Connect** + + ![Image of set credentials](images/power-bi-set-credentials-organizational-cont.png) + +- View the results of your query + + ![Image of query results](images/power-bi-query-results.png) + +## Related topic +- [Create custom Power BI reports with app authentication](run-advanced-query-sample-power-bi-app-token.md) +- [Windows Defender ATP APIs](exposed-apis-intro.md) +- [Advanced Hunting API](run-advanced-query-api.md) +- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) +- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md)