Incident statistics querying (for a powerbi dashboard)

[mclaes]

hey all,

I'm creating a PowerBI dash to report on some SOC statistics for the wider IT org to look at. Getting an alert view in is easy using a KQL query in PowerBI format. 

But I don't see how I can get to Incident statistics. Looking to show Nr of incidents per status / priority .. etc. Is there a way to do this?

thanks!

[#2 · Accepted solution]

@mclaes Take a look at my blog post to see if that answers your questions.  https://www.garybushey.com/2020/01/20/azure-sentinel-incidents-in-powerbi/

[#3]

Hey Gary,

Thanks alot for your howto guide! Managed to create a similar dashboard in under 30' :)

I did however needed to change the "& " in your Power Query code snippet back to a "&" to get the query to work.

[#4]

@mclaes Thanks for that tip.  Perils of cut and paste :)

[#5]

thank you for the blog. However this M code doesnt allow to refresh the dataset on power bi Service (cloud) because it contains dynamic sources that refrains it to refresh. do you have a workaround?@Gary Bushey