Try It
Print

Dataset Parameters Explained

Copy the URL link to this section to share

The BI for Defender dataset contains some parameters that must be configured in order to synchronize data from Defender for Endpoint to Power BI. Other parameters add additional functionality to BI for Defender. This article explains each of the parameters in detail.

Step

  1. To view or modify the dataset parameters select Workspaces.
  2. Select the BI for Defender workspace.
defender workspace
(click to enlarge)
Step

  1. Hover over the bi_for_defender Sematic model to reveal a kebab menu (three vertical dots).
  2. Select the kebab menu.
  3. Select Settings.
defender settings
(click to enlarge)
Step

  1. Expand Parameters.
(click to enlarge)
Step

ApiKey

  1. Required configuration: Yes
  2. Default value: Blank
  3. This should be the API Key that you received from us after completing the Request a Trial Key form.
(click to enlarge)
Step

AzureAD TenantID

  1. Required configuration: Yes
  2. Default value: Blank
  3. This should be your Azure AD tenant ID. 
  4. Note: An easy way to get this is to go to https://www.whatismytenantid.com/
(click to enlarge)
Step

AzureAD ClientID

  1. Required configuration: Yes
  2. Default value: Blank
  3. The Application (client) ID from the Azure AD App Registration.
(click to enlarge)
Step

AzureAD ClientSecret

  1. Required configuration: Yes
  2. Default value: Blank
  3. The Azure AD Client Secret is the most common mistake that customers make when installing BI for Defender.  It is shown as the "Value" when adding the client secret to the Azure AD App Registration. The Client Secret does not have dashes (-) in it. The Client Secret looks similar to this: iB9GT~dZg.F.AKvxzMzjk7T1kIzlFocEh4JXcgI
(click to enlarge)
Step

AzureAD Pace API (s)

  1. Required configuration: None
  2. Default value: 0
  3. Determines the amount of time the sync process waits for a response from the Pace API's and then it loops until a response is received. Do not change this value unless instructed to do so by PowerStacks support.
(click to enlarge)
Step

AzureAD AdvancedHunting Application Control Day(s)

  1. Required configuration: None
  2. Default value: 3 days
  3. Max value: 30
  4. -1 disables this feature.
azuread advancedhunting application control day
(click to enlarge)
Step

AzureAD AdvancedHunting PageSize API

  1. Required configuration: None
  2. Default value: 10000
  3. Determines the page size for MS Graph queries. Do not change this value unless instructed to do so by PowerStacks support.
azuread advancedhunting pagesize api
(click to enlarge)
Step

AzureAD Export URL Enable

  1. Required configuration: Yes, only if the AzureAD Export URL has been populated.
  2. Default value: FALSE
  3. Determines if the URL from the AzureAD Export URL is used or if the URL is found automatically by the app. 
  4. Setting this parameter to TRUE will create a new data source credential that must be configured.
    1.  Authentication method: Anonymous
    2. Privacy Level: Organizational
    3. Check "Skip test connection"
(click to enlarge)
Step

AzureAD Export URL

  1. Required configuration: None
  2. Default value: Blank
  3. The export URL varies from one Azure tenant to another. If this value is not populated our code will find the correct URL that your Intune environment uses to export data, however, to avoid redirection and improve security it is recommended to set this parameter.
  4. Be sure to also set AzureAD Export URL Enable = TRUE when using this parameter.
  5. To learn more please see our Configure Defender Export API documentation. 
(click to enlarge)
Step

AzureAD AdvancedHunting Process Day(s)

  1. Required configuration: None
  2. Default value: 1 days
  3. Max value: 30
  4. -1 disables this feature.
  5. Allows you to configure the number of days of process data to pull from Advanced Hunting.
azuread advancedhunting process day
(click to enlarge)
Step

AzureAD PageSize API

  1. Required configuration: None
  2. Default value: 10000
  3. Determines the page size of queries. Do not change this value unless instructed to do so by PowerStacks support.
(click to enlarge)
Step

AzureAD Proxy Enable

  1. Required configuration: Yes
  2. Default value: True
  3. Should ALWAYS be False unless you are viewing the reports with the demo data.
azuread proxy enable
(click to enlarge)
Step

AzureAD AdvancedHunting Day(s)

  1. Required configuration: None
  2. Default value: 30
  3. Allows you to configure the number of days of data to pull from Advanced Hunting.
azuread advancedhunting process day
(click to enlarge)
Step

AzureAD Export URL Wait (s)

  1. Required configuration: None
  2. Default value: 1
  3. Determines the amount of time the sync process waits for each Intune export job to report a status and then loops until a status is received. Do not change this value unless instructed to do so by PowerStacks support.
(click to enlarge)
Step

AzureAD Export URL Timeout (s)

  1. Required configuration: None
  2. Default value: 3600
  3. Determines the amount of time the sync process waits for each Intune export job before it times out. Do not change this value unless instructed to do so by PowerStacks support.
(click to enlarge)
Step

AzureAD Login URL

  1. Required configuration: None
  2. Default value: https://login.microsoftonline.com
  3. This parameter is only used in edge cases where customers have some things in GCC or HCC High and other things in the commercial cloud.
azuread login url
(click to enlarge)
Step

AzureAD Graph URL

  1. Required configuration: None
  2. Default value: https:/graph.microsoft.com
  3. This parameter is only used in edge cases where customers have some things in GCC or HCC High and other things in the commercial cloud.
azuread graph url
(click to enlarge)
Step

AzureAD SecurityCenter URL

  1. Required configuration: None
  2. Default value: https://api.securitycenter.microsoft.com
  3. This parameter is only used in edge cases where customers have some things in GCC or HCC High and other things in the commercial cloud.
  4.  
azuread securitycenter url
(click to enlarge)
Step

AzureAD Vulnerability History Day(s)

  1. Required configuration: None
  2. Default value: 1
  3. By default, only vulnerability data from the last 1 day are available in the reports. Getting more days of vulnerability data will result in slower synchronizations and possibly cause synchronization timeouts. The max value is 30.
  4. Note, vulnerability data can be completely disabled by setting this value to -1.
azuread vulnerability history day
(click to enlarge)
Step

AzureAD Vulnerability History PageSize API

  1. Required configuration: None
  2. Default value: 200000
  3. Do not change this value unless instructed to do so by PowerStacks support. 
azuread vulnerability history pagesize api
(click to enlarge)