Forum Discussion
How can I share hunting query results with non-security persons in my org?
Advanced hunting logs have rich data that can be helpful to my orgs help desk for figuring out things like machines that are causing account lockouts for failed logon events and such. I'd like to sha...
Robina thank you for the tip! So, are you talking about making a data source like this in https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-power-bi?view=o365-worldwide#connect-power-bi-to-advanced-hunt or is there some inherent source that I can use. I don't see any "Advanced Hunting" data source when making a new report.
- To filter and extract the pertinent information from your advanced hunting logs, utilise the Kusto Query Language (KQL). Then, export the information to a CSV or Excel file that can be shared with non-security users. The export operator in KQL can be used for this. The query can also be scheduled to run at predetermined intervals, with the results being sent via email to the appropriate parties. check out here Advanced Hunting
- Create a Power BI report that pulls in data from your advanced hunting logs using the Power BI Desktop application. You can use the "Get Data" feature in Power BI to connect to your log data and create custom visualizations that highlight the relevant information. You can then publish the report to the Power BI service and share it with the appropriate individuals in your organization.
Use Azure Sentinel to create a custom dashboard that displays the results of your advanced hunting queries. You can configure the dashboard to only display the information that is relevant to non-security users, and then share the dashboard with those individuals.