SOLVED

Problems with PowerBI Templates - issues with Schema

%3CLINGO-SUB%20id%3D%22lingo-sub-1550015%22%20slang%3D%22en-US%22%3EProblems%20with%20PowerBI%20Templates%20-%20issues%20with%20Schema%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1550015%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20getting%20the%20following%20error%20in%20many%20of%20the%20PowerBI%20templates%20%2C%20when%20I%20review%20the%20schema%20at%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fmicrosoft-defender-atp%2Fadvanced-hunting-schema-reference%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fmicrosoft-defender-atp%2Fadvanced-hunting-schema-reference%3C%2FA%3E%2C%20i%20don't%20see%20a%20table%20called%20MiscEvents.%20Does%20anyone%20know%20how%20to%20fix%20these%20queries%3F%3C%2FP%3E%3CP%3EWeb.Contents%20failed%20to%20get%20contents%20from%20'%3CA%20href%3D%22https%3A%2F%2Fapi.securitycenter.windows.com%2Fapi%2Fadvancedqueries%3Fkey%3DMiscEvents%250A%257C%2520where%2520ActionType%2520startswith%2520%2527AppControl%2527%250A%257C%2520extend%2520ValidatedSigningLevel%2520%3D%2520parsejson(AdditionalFields).ValidatedSigningLevel%250A%257C%2520extend%2520AuthenticodeHash%2520%3D%2520parsejson(AdditionalFields).AuthenticodeHash%250A%257C%2520project%2520FileName%2C%2520ActionType%2C%2520FolderPath%2C%2520ValidatedSigningLevel%2C%2520AuthenticodeHash%2C%2520MachineId%2C%2520EventTime%2520%250A%257C%2520summarize%2520dcount(MachineId)%2520by%2520FileName%2C%2520EventTime%2C%2520ActionType%2C%2520FolderPath%2C%2520tostring(AuthenticodeHash)%2C%2520tostring(ValidatedSigningLevel)%250A%257C%2520top%252010000%2520by%2520dcount_MachineId%2520desc%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fapi.securitycenter.windows.com%2Fapi%2Fadvancedqueries%3Fkey%3DMiscEvents%250A%257C%2520where%2520ActionType%2520startswith%2520'AppControl'%250A%257C%2520extend%2520ValidatedSigningLevel%2520%3D%2520parsejson(AdditionalFields).ValidatedSigningLevel%250A%257C%2520extend%2520AuthenticodeHash%2520%3D%2520parsejson(AdditionalFields).AuthenticodeHash%250A%257C%2520project%2520FileName%2C%2520ActionType%2C%2520FolderPath%2C%2520ValidatedSigningLevel%2C%2520AuthenticodeHash%2C%2520MachineId%2C%2520EventTime%2520%250A%257C%2520summarize%2520dcount(MachineId)%2520by%2520FileName%2C%2520EventTime%2C%2520ActionType%2C%2520FolderPath%2C%2520tostring(AuthenticodeHash)%2C%2520tostring(ValidatedSigningLevel)%250A%257C%2520top%252010000%2520by%2520dcount_MachineId%2520desc%3C%2FA%3E'%20(400)%3A%20Bad%20Request.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1550015%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPowerBi%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1552617%22%20slang%3D%22en-US%22%3ERe%3A%20Problems%20with%20PowerBI%20Templates%20-%20issues%20with%20Schema%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1552617%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1096%22%20target%3D%22_blank%22%3E%40Dean%20Gross%3C%2FA%3Eyou%20are%20using%20the%20old%20table%20schema.%20Please%20update%20your%20queries%20to%20the%20new%20schema.%3C%2FP%3E%3CP%3EYou%20can%20find%20the%20changes%20documented%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-defender-atp%2Fadvanced-hunting-data-schema-changes%2Fba-p%2F1043914%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-defender-atp%2Fadvanced-hunting-data-schema-changes%2Fba-p%2F1043914%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1552904%22%20slang%3D%22en-US%22%3ERe%3A%20Problems%20with%20PowerBI%20Templates%20-%20issues%20with%20Schema%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1552904%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F382145%22%20target%3D%22_blank%22%3E%40NiklasM%3C%2FA%3E%26nbsp%3BThank%20you%2C%20I%20had%20a%20vague%20memory%20of%20reading%20about%20this%20but%20could%20not%20find%20it%20in%20the%20actual%20docs.%20I%20wonder%20why%20the%20PowerBI%20templates%20that%20have%20been%20released%20this%20year%2C%20still%20have%20the%20old%20schema%3C%2FP%3E%3C%2FLINGO-BODY%3E
Respected Contributor

I am getting the following error in many of the PowerBI templates , when I review the schema at https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-..., i don't see a table called MiscEvents. Does anyone know how to fix these queries?

Web.Contents failed to get contents from 'https://api.securitycenter.windows.com/api/advancedqueries?key=MiscEvents%0A%7C%20where%20ActionType...' (400): Bad Request.

2 Replies
Best Response confirmed by Dean Gross (Respected Contributor)
Solution

@Dean Grossyou are using the old table schema. Please update your queries to the new schema.

You can find the changes documented here: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/b...

 

@NiklasM Thank you, I had a vague memory of reading about this but could not find it in the actual docs. I wonder why the PowerBI templates that have been released this year, still have the old schema