Defender voor Cloud gegevens toevoegen aan Power BI

Door de gegevens van Microsoft Defender voor Cloud te verbinden met Microsoft Power BI, kunt u uw metrische beveiligingsgegevens eenvoudig bewaken en analyseren. Met de integratie kunt u beveiligingsinzichten visualiseren en snel potentiële bedreigingen en beveiligingsproblemen identificeren. In dit artikel wordt u begeleid bij de stappen voor het verbinden van Defender voor Cloud gegevens met Power BI, zodat u complexe beveiligingsinformatie kunt transformeren in duidelijke, bruikbare inzichten.

Vereisten

• Download en installeer Power BI Desktop.

• Zorg ervoor dat u over de juiste machtigingen beschikt om toegang te krijgen tot Azure Resource Graph.

Power BI verbinden met Azure Resource Graph

Voordat u de gegevens van Defender voor Cloud met Power BI kunt verbinden, moet u Eerst Power BI verbinden met Azure Resource Graph.

1. Open Power BI Desktop op uw bureaublad.

2. Selecteer Leeg rapport.

3. Selecteer Meer gegevens> ophalen.

   

4. Zoek en selecteer Azure Resource Graph.

5. Selecteer Verbinding maken.

Query's uitvoeren op Defender voor Cloud gegevens in Power BI

Zodra Power BI Desktop is verbonden met Azure Resource Graph, kunt u Azure Resource Graph gebruiken om vanuit Defender voor Cloud query's uit te voeren op verschillende gegevensbronnen in Power BI.

De query's op deze pagina zijn voorbeelden die resultaten bieden. Met Azure Resource Graph kunt u een groot aantal gegevens opvragen die u kunt maken en aanpassen om resultaten te retourneren die aansluiten bij uw specifieke vereisten.

1. Kopieer en plak een van de opgegeven query's in de query-editor in Power BI Desktop.

   Aanbevelingen per risico

   Met deze query worden beveiligingsaanvelingen opgehaald op basis van risico's van MDC, zodat u evaluaties kunt analyseren en gebieden kunt identificeren die aandacht nodig hebben.

   securityresources 
           | where type =~ "microsoft.security/assessments"
           | extend assessmentType = iff(type == "microsoft.security/assessments", tostring(properties.metadata.assessmentType), dynamic(null))
           | where (type == "microsoft.security/assessments" and (assessmentType in~ ("BuiltIn", "CustomerManaged")))
           | extend assessmentTypeSkimmed = iff(type == "microsoft.security/assessments", case(
                       tostring(properties.metadata.assessmentType) == "BuiltIn", "BuiltIn",
                       tostring(properties.metadata.assessmentType) == "BuiltInPolicy", "BuiltIn",
                       tostring(properties.metadata.assessmentType) == "CustomPolicy", "Custom",
                       tostring(properties.metadata.assessmentType) == "CustomerManaged", "Custom",
                       tostring(properties.metadata.assessmentType) == "ManualCustomPolicy", "Custom",
                       tostring(properties.metadata.assessmentType) == "ManualBuiltInPolicy", "BuiltIn",
                       dynamic(null)
                   ), dynamic(null))
           | extend assessmentId = tolower(id)
           | extend assessmentKey = iff(type == "microsoft.security/assessments", name, dynamic(null))
           | extend source = iff(type == "microsoft.security/assessments", trim(' ', tolower(tostring(properties.resourceDetails.Source))), dynamic(null))
           | extend statusCode = iff(type == "microsoft.security/assessments", tostring(properties.status.code), dynamic(null))
           | extend resourceId = iff(type == "microsoft.security/assessments", trim(" ", tolower(tostring(case(source =~ "azure", properties.resourceDetails.Id,
               (type == "microsoft.security/assessments" and (source =~ "aws" and isnotempty(tostring(properties.resourceDetails.ConnectorId)))), properties.resourceDetails.Id,
               (type == "microsoft.security/assessments" and (source =~ "gcp" and isnotempty(tostring(properties.resourceDetails.ConnectorId)))), properties.resourceDetails.Id,
               source =~ "aws", properties.resourceDetails.AzureResourceId,
               source =~ "gcp", properties.resourceDetails.AzureResourceId,
               extract("^(?i)(.+)/providers/Microsoft.Security/assessments/.+$",1,id)
               )))), dynamic(null))
           | extend resourceName = iff(type == "microsoft.security/assessments", tostring(coalesce(properties.resourceDetails.ResourceName, properties.additionalData.CloudNativeResourceName, properties.additionalData.ResourceName, properties.additionalData.resourceName, split(resourceId, '/')[-1], extract(@"(.+)/(.+)", 2, resourceId))), dynamic(null))
           | extend resourceType = iff(type == "microsoft.security/assessments", tolower(properties.resourceDetails.ResourceType), dynamic(null))
           | extend riskLevelText = iff(type == "microsoft.security/assessments", tostring(properties.risk.level), dynamic(null))
           | extend riskLevel = iff(type == "microsoft.security/assessments", case(riskLevelText =~ "Critical", 4,
                     riskLevelText =~ "High", 3,
                     riskLevelText =~ "Medium", 2,
                     riskLevelText =~ "Low", 1,
                     0), dynamic(null))
           | extend riskFactors = iff(type == "microsoft.security/assessments", iff(isnull(properties.risk.riskFactors), dynamic([]), properties.risk.riskFactors), dynamic(null))
           | extend attackPaths = array_length(iff(type == "microsoft.security/assessments", iff(isnull(properties.risk.attackPathsReferences), dynamic([]), properties.risk.attackPathsReferences), dynamic(null)))           
           | extend displayName = iff(type == "microsoft.security/assessments", tostring(properties.displayName), dynamic(null))
           | extend statusCause = iff(type == "microsoft.security/assessments", tostring(properties.status.cause), dynamic(null))
           | extend isExempt = iff(type == "microsoft.security/assessments", iff(statusCause == "Exempt", tobool(1), tobool(0)), dynamic(null))
           | extend statusChangeDate = tostring(iff(type == "microsoft.security/assessments", todatetime(properties.status.statusChangeDate), dynamic(null)))
           | project assessmentId,
                       statusChangeDate,
                       isExempt,
                       riskLevel,
                       riskFactors,
                       attackPaths,
                       statusCode,
                       displayName,
                       resourceId,               
                       assessmentKey,
                       resourceType,
                       resourceName,
                       assessmentTypeSkimmed               
               | join kind=leftouter (
                   securityresources
                   | where type == 'microsoft.security/assessments/governanceassignments'
                   | extend assignedResourceId = tolower(iff(type == "microsoft.security/assessments/governanceassignments", tostring(properties.assignedResourceId), dynamic(null)))
                   | extend dueDate = iff(type == "microsoft.security/assessments/governanceassignments", todatetime(properties.remediationDueDate), dynamic(null))
                   | extend owner = iff(type == "microsoft.security/assessments/governanceassignments", iff(isempty(tostring(properties.owner)), "unspecified", tostring(properties.owner)), dynamic(null))
                   | extend governanceStatus = iff(type == "microsoft.security/assessments/governanceassignments", case(
                               isnull(todatetime(properties.remediationDueDate)), "NoDueDate",
                               todatetime(properties.remediationDueDate) >= bin(now(), 1d), "OnTime",
                               "Overdue"
                           ), dynamic(null))
                   | project assignedResourceId, dueDate, owner, governanceStatus
               ) on $left.assessmentId == $right.assignedResourceId
               | extend completionStatusNumber = case(governanceStatus == "Overdue", 5,
                                                          governanceStatus == "OnTime", 4,
                                                          statusCode == "Unhealthy", 3, 
                                                          isExempt, 7,
                                                          1)
                   | extend completionStatus = case(completionStatusNumber == 5, "Overdue",
                                                    completionStatusNumber == 4, "OnTime",
                                                    completionStatusNumber == 3, "Unassigned",
                                                    completionStatusNumber == 7, "Exempted",
                                                    "Completed")
               | where completionStatus in~ ("OnTime","Overdue","Unassigned")
               | project-away assignedResourceId, governanceStatus, isExempt
                          | order by riskLevel desc, attackPaths desc, displayName
   

   Aanvalspaden

   Gebruik deze query om gegevens over aanvalspaden op te halen, zodat u inzicht verleent in mogelijke aanvalsvectoren in uw cloudomgeving.

   securityresources
   | where type == "microsoft.security/attackpaths"
   | extend riskCategories = tostring(properties.riskCategories)
   | extend riskCategories = tostring(split(riskCategories, "[")[1])
   | extend riskCategories = tostring(split(riskCategories, "]")[0])
   | extend riskCategory = iff('{riskCategories}' == "All", riskCategories, '{riskCategories}')
   | where riskCategories has(riskCategory)
   | project apId = name, apTemplate = tostring(properties.displayName), riskCategories
   | summarize Path_Count = count() by Attack_Path = apTemplate, riskCategories
   | project Attack_Path, Path_Count, riskCategories
   

   Beveiligingsscore

   Met deze query worden beveiligingsscoregegevens opgehaald, zodat u inzicht krijgt in uw algehele beveiligingspostuur en prioriteit geeft aan herstelactiviteiten.

   securityresources 
   | where type == "microsoft.security/securescores" 
   | where name == "ascScore"
   | extend environment = tostring(properties.environment)
   | extend scopeMaxScore = toint(properties.score.max)
   | extend scopeWeight = toint(properties.weight)
   | extend scopeScorePerc = round(todouble(properties.score.percentage), 0)
   

   Governance

   Gebruik deze query om gegevens over governanceregels op te halen, zodat u het nalevings- en governancebeleid effectief kunt beheren.

   securityresources         
   | where type == "microsoft.security/assessments"
   | where isnull(properties.resourceDetails.AwsResourceId) and isnull(properties.resourceDetails.GcpResourceId)
   | extend DisplayName = tostring(properties.displayName)
   | where isempty(DisplayName) == false
   | join kind=leftouter   (securityresources         
   | where type == "microsoft.security/assessments/governanceassignments"
   | extend  assignedResourceId = tostring(todynamic(properties).assignedResourceId)
   | extend remediationDueDate = todatetime(properties.remediationDueDate)
   | project id = assignedResourceId, governanceassignmentsProperties = todynamic(properties), remediationDueDate) on id
   | extend hasAssignment = isempty( governanceassignmentsProperties) == false and isnull( governanceassignmentsProperties) == false
   | extend assignmentStatus = iif(tostring(properties.status.code) == "Unhealthy",iif(hasAssignment == true, iif(bin(remediationDueDate, 1d) < bin(now(), 1d), "Overdue", "Ontime"), "Unassigned") , "Completed")
   | summarize count() by assignmentStatus
   

   Naleving

   Met deze query worden nalevingsgegevens opgehaald uit MDC, wat essentieel is voor het onderhouden en demonstreren van naleving van verschillende wettelijke vereisten.

   securityresources
   | where type == "microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments" | extend scope = properties.scope
   | where isempty(scope) or  scope in~("Subscription", "MultiCloudAggregation")
   | parse id with * "regulatoryComplianceStandards/" complianceStandardId "/regulatoryComplianceControls/" complianceControlId "/regulatoryComplianceAssessments" *
   | extend complianceStandardId = replace( "-", " ", complianceStandardId)
   | extend Status = properties.state
   

2. Selecteer OK.

   

   Notitie

   Standaard beperkt Resource Graph elke query tot het retourneren van slechts 1000 records. Met dit besturingselement worden zowel u als de service beschermd tegen onbedoelde query's die leiden tot grote gegevenssets. Als u wilt dat queryresultaten niet worden afgekapt door de limiet van 1000 records, stelt u de waarde van de 'Geavanceerde optie - $resultTruncated (optioneel)' in op FALSE.

   

3. Selecteer Laden.

Met Azure Resource Graph beschikt u over de flexibiliteit om gegevens op te halen en te analyseren die beschikbaar zijn in uw Defender voor Cloud-omgeving, zodat u uitgebreide en op maat gemaakte inzichten kunt verkrijgen en analyseren. Zodra uw gegevens zijn toegevoegd aan Power BI, kunt u visualisaties en dashboards maken om uw beveiligingspostuur effectief te bewaken en te beheren.

Volgende stap

Visualisaties toevoegen in Power BI