Kusto on Microsoft 365 Defender - security

How can I show Incidents/Alerts in Kusto using their investigation state ?
TO get all the incidents/alerts that under that state

Related

What is the difference between Power BI and Azure analyses services

I'm trying to understand the difference between those two things: Power BI and Azure Analyses Services.
Is that the same? What advantages does AAS give using it with Power BI?
I found a lot of articles comparing Power BI Premium with AAS. But what if I have "pro" version? It's still unclear in which case I should use any of these tools.
I will be thankful if somebody explains what is each tool for. Thanks in advance
It is oversimplified, but we could say that Azure Analysis Services (AAS) is a cloud version of SQL Server Analysis Services (SSAS). But while SSAS has some data visualization capabilities, AAS is intended to build data models in Azure. Usually Excel, Power BI or another tool is used to visualize and analyze these models. Think for AAS and SSAS as a place, where you can store your data and build data models, while Power BI is a layer above it.
Power BI is also a broad set of tools. You can use Power BI Desktop application to design and build reports. It can connects to hundreds different data sources and can be used on your Windows PC completely free, even without an account for Power BI. Under the hood, it runs SSAS to store the data and the model, but this is transparent for the user.
Power BI Service is a service provided by Microsoft, where you can publish reports made with Power BI Desktop, and then these reports can be seen in a web browser. These reports are hosted and rendered in a shared infrastructure, which means that your reports are hosted and rendered on the same servers, as reports by other users. To be able to publish reports there, you must have an account for Power BI. They are two types - a free one and Pro. So Power BI Pro is just a paid ($10/user/month) license to use Power BI Service.
Power BI Premium is an offering from Microsoft, which gives you a dedicated hardware (they call it capacity) to host and render your Power BI reports. So if you publish a report to Power BI Service, you can buy a dedicated capacity (either Power BI Premium or Power BI Embedded) and assign your reports to it - then it will be used to render your reports and it will not be shared with other Power BI users. You can think for this as a "shared web hosting" vs "dedicated web server/VPS hosting". Power BI Premium is quite expensive and can't be paused (i.e. using it or not, you pay a monthly fee), while Power BI Embedded is a similar offering, but as an Azure service, which doesn't has this commitment and can be paused when not used (think for this as a VM in Azure, which you can start and stop whenever you want).
Power BI Premium has different SKUs - P1, P2, P3, EM1, etc. These P SKUs gives you some additional options. Normally, to share a report published in Power BI Service, both you and the users which whom the report is shared, should have Power BI Pro licenses. If you pay for Premium P SKU, then only the publisher of the report must pay for a Pro license, while the consumers can use Power BI Free licenses. So Power BI Premium usually is cost effective for organizations with a large number of users.

Microsoft BI Architecture: Power BI, Paginated Reports, Analysis Services and Cloud - what is the optimal solution?

I am looking for some opinions and suggestions re Microsoft BI Architecture. Need to design a BI architecture that supports:
Self-Service BI - thinking of Power BI
Enterprise Level modelling with proper source control, data security and multi-lingual support -
thinking of Analysis Services
Standard Reporting (paginated reports)- thinking of SSRS or Power BI Report Builder
Hybrid Infrastructure - both on premise and cloud data sources, including MS SQL, Azure and
SAP BW and SAP HANA
So I have identified the products I need. The problem is - they are part of different services. For now it looks that we would need:
Option 1) Power BI Premium to support Paginated Reports and Self-service BI and Separate Analysis Services for modelling (Power BI Premium lacks key features like multi-language support, column/object level security, enterprise level AML).
Option 2) Power BI Pro for Viz and self-service BI, SSRS for Paginated Reports and Analysis Services for Modelling. However here I am not sure if SSRS is available on Azure. And how easy it would be to manage three different products, especially if data is residing on premise and in the cloud.
Anyone had to do similar exercise? What have you've chosen? For now, I would love to avoid having to purchase Power BI Premium, but I do need to support paginated reports and maximise the use of Power BI PRO licences (hundreds of users).
Thank You!
At the moment, the best way to combine SSRS and PBI in one portal is Power BI Premium, however you can do this in the cheaper Power BI Embedded Service. The main draw back will be for Embedded A SKU's, building your own portal to surface them. If you don't need external users, then you can use the EM version and show PBI and SSRS in Sharepoint/Teams etc. You'll also be able to reduce the cost of purchasing 100s of Pro licenses as like Premium, your free users are able to see the reports.
SSRS in not available as an Azure service, however you can spin up a VM with SQL Server (Standard & Enterprise) and host the SSRS site there. You can also Pin SSRS reports to the Power BI Service, but pinning doesn't give the best user experience.
Analysis Services (AS) will always be a better choice of the data modelling, as it overcomes the limitations of the Power BI service, as you have noted. Surfacing the data in AS, allows user to connect with Excel, PBI, SSRS and other reporting tools, so option 2 will be your best option.
Managing the different services will but time consuming, but unavailable, you can use Active Directory to limit access etc, so only the relevant users can connect, build and consume reports, other processes may have to be defined on your own requirements.
From the projects I've encountered, it tends to be option 2, customers still have some on-prem SSRS and use PBI as a complementary reporting platform. However most are moving away from SSRS to PBI and Excel. Excel is used for table based reporting and dumps of data. A number of projects have SQL Server Enterprise with Software assurance, that allows them to deploy Power BI Report Server on-prem rather than use the PBI Service.

How to create workspace in A1 cored PowerBI service in azure portal?

Over the months of exploration into PBI, started with successfully creating a workspace using PowerBI pro license and ended with hosting a pbi report embedding into my custom MVC site using apps-own-data model.
First experience is maximum allowed embedded tokens running out.
My company decided to create a dedicated A1 core powerbi embedded service in a azure account. Now I have overcame token running out of count issue but seems cringy that my powerbi embedded service besides paused still my embedded site runs and accesses powerbi reports without any interruption.
Previously have created AD using embed tool provided by microsoft. I can see my AD been created in azure portal too.
How this is possible to view a pbi report where my azure powerbi embedded service been paused.
Am i supposed to use those pbi reports without getting billed?
Microsoft has limited information on documentation to clarify my doubts, but the PBI community site is somewhat helpful still having trouble getting clarification for the same.
Help required.
For your question:
How this is possible to view a pbi report where my azure powerbi embedded service been paused. Am i supposed to use those pbi reports without getting billed?
If the A1 Node is paused, then no, you will not be able to see your report or use the service in your front end. It has to be running to deliver the reports in your custom front end. You can still go into the Power BI Service with an assigned Power BI Pro licence and see your report, the workspace that the report has been deployed to, is flagged as 'embedded capacity' that will be shown as a diamond shape next to it.
You allocate the workspace to a capacity by editing the workspace and selecting the 'Advanced' option then 'Dedicated Capacity'
The MS documentation outlines pausing will not deliver content.
Pausing a capacity may prevent content from being available within
Power BI. Make sure to unassign workspaces from your capacity before
pausing to prevent interruption.
Pausing is designed to allow you to stop delivering connect for example, out side business hours, I have a few clients that only run their internal and external report during 7am to 7pm, the other 12 hours the service is paused. The A sku billing costs are reduced to 50%.
Hope that helps

How to Create a Power BI Embedded Resource

I'm trying to create a Power BI Embedded resource from azure. I followed all the steps noted in section 1 of the following link Power BI Embedded namely, creating a user in Active Directory, creating a Power BI Pro account with this usage, An application on Azure Active Directory.
Still, I still have the same page that appears.
Does anyone have any idea what that is?
Thanks
Azure Power BI Embedded Image
The service Power BI Embedded is deprecated, and if you havend used it before you will no longer be able to create that service in Azure. This happend roughly two weeks ago
The message on Azure is supposed to be interpreted as
You can no longer create this service, instead use the following guide
to embed Power BI and do not return to this page after
So, you have completed step 1. Now you should move to step 2, Embed Content. Creating a Power BI Embedded service in Azure is no longer a step in how to embed Power BI.
If you ask me, a good start for step 2 is https://github.com/Microsoft/PowerBI-Developer-Samples where you should start with the App Owns Data samples.

Microsoft Azure realtime charts for externals

since a couple of weeks I'm working with Microsoft Azure and I wonder if there is a possibility to create realtime charts in my Web App for external customers.
I know Microsoft provides two different services called 'Power BI', which supports realtime charts and 'Power BI embedded'. But my problem is that, as far as I know, Power BI is only intended for internal users and Power BI embedded, which is inteded for charts e.g. in Web Apps for external customers, only provides reports which are not realtime.
Am I missing something or is it currently not possible to provide realtime charts inside web apps with the given services of Azure? If yes, what would be alternatives to achieve my goal?
Thank you very much in advance.
Kind regards,
Felix
I would look at Power BI Embedded, with the data source using a Direct Query connection to Azure SQL Database or Azure SQL Datawarehouse. Every user action in the report (filtering, drilling etc) will generate a query against the database.
That Power BI Embedded architecture is explained on this page:
https://learn.microsoft.com/en-us/azure/power-bi-embedded/power-bi-embedded-what-is-power-bi-embedded
Direct Query is explained on this page:
https://powerbi.microsoft.com/en-us/documentation/powerbi-azure-sql-database-with-direct-connect/
1) Consider that Real Time is like in an IOT scenario where you see your graphics on your dashboard moving in Real Time and not after a refresh. So in this context you should consider using Azure Stream Analytics Jobs. It's get an input from a blob storage, an event Hub, ..., and then in output you can use your power BI account to write in real time events ingested from Azure Streaming Analytics. Very powerfull! you use SQL for querying the input, the only thing to be aware is the thumbling time window that is somehow new to the SQL language.
2) Letting your customer access to the dashboard I would suggest you to pubblicate your dashboard for free access, and then secure your dashboard inside a web app on which you can apply a security pattern. You can also invite people outside of your organisation via email. Which is faster than the previous solution, but people accessing to your report must have a power BI Pro license. You can use the free trial for 60 days.
Hope that helps!
Cheers!

Resources