{
  "id": "OfficePowerBI",
  "title": "Microsoft PowerBI",
  "publisher": "Microsoft",
  "logo": "PowerBILogo.svg",
  "descriptionMarkdown": "Microsoft PowerBI is a collection of software services, apps, and connectors that work together to turn your unrelated sources of data into coherent, visually immersive, and interactive insights. Your data may be an Excel spreadsheet, a collection of cloud-based and on-premises hybrid data warehouses, or a data store of some other type. This connector lets you stream PowerBI audit logs into Microsoft Sentinel, allowing you to track user activities in your PowerBI environment. You can filter the audit data by date range, user, dashboard, report, dataset, and activity type.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "Microsoft PowerBI",
      "baseQuery": "PowerBIActivity"
    }
  ],
  "sampleQueries": [
    {
      "description": "Office PowerBI Logs",
      "query": "PowerBIActivity\n            | sort by TimeGenerated"
    }
  ],
  "connectivityCriterias": [
    { "type": "SentinelKinds", "value": ["OfficePowerBI"] }
  ],
  "dataTypes": [
    {
      "name": "PowerBIActivity",
      "lastDataReceivedQuery": "PowerBIActivity\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": true
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": { "read": true, "write": true, "delete": true }
      }
    ],
    "tenant": ["GlobalAdmin", "SecurityAdmin"],
    "customs": [
      {
        "name": "License",
        "description": "Microsoft Power BI eligible license is required."
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "Connect Microsoft PowerBI audit logs to Microsoft Sentinel",
      "description": "This connector uses the Office Management API to get your PowerBI audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **PowerBIActivity** table.",
      "instructions": [
        {
          "parameters": {
            "connectorKind": "OfficePowerBI",
            "title": "Microsoft PowerBI",
            "enable": true
          },
          "type": "SentinelResourceProvider"
        }
      ]
    }
  ]
}