By Tony Lee
Welcome to part IV in this series of going from zero to hero using Power BI to ingest, process, and make amazing reports. If you have read some of our other articles you can probably tell by now that we enjoy making data actionable. Honestly, it doesn't matter what type of data or even where the data ends up. As long as we can make informed decisions using the data -- we love it. Following in this theme we are going to make BlackBerry (formerly known as Cylance) Protect Threat Data Report (TDR) CSVs actionable using Power BI and Power BI Desktop. You can use any data source to follow along in this series, but our example BlackBerry Protect report is shown below which we are happily sharing the Power BI template (.pbit) at the github link below so you can load and analyze your own data!
https://github.com/TonyLeeVT/BlackBerryProtectTDR-PowerBIViewer
 | |
|
In the first article, we covered:
- Getting Started
- Data Ingest
- Adjusting Fields
- Visualizations
- Saving Your Work
In the second article, we covered:
- Tabs
- More Visualizations
- Text box
- Slicer
- Table
- Pie Charts
- Treemap
- Using Reports and Dashboards
- Uploading Reports to Power BI Service (Online)
In the third article, we covered:
- Question and Answer (Q&A) Feature
- Power BI for Mobile
- Changing the Data Source
- Scheduling Data Refresh
In this article, we will cover:
- Matrix and Decomposition Visualizations
- Inserting Images with Actions
- Tooltips
- Parameters
- Power BI Templates
Matrix and Decomposition Visualizations
We just wanted to give a shout out to two very cool visualizations that help with analyst workflow. The first being the matrix visualization which allows you to hierarchically dig into data by expanding rows or columns. To create the Matrix, we used Policy Name, Section, and Key as the Row value + Last Value as the Values.
 |
| Figure 2: Interactive matrix of policy configurations |
The second visualization is Decomposition which allows you to visually analyze large amounts of data by viewing and summing common values. To create the Decomposition, we use the distinct count of Policy Name for the Analyze field and Explaining by the Section, Key, and Value.
 |
| Figure 3: Interactive decomposition visualization of policy configurations |
Both of these visualizations ended up being perfect for our Policy Explorer Report shown as the first image in this article. Note: This test environment has more policies than what is typically found in large and complex environments, but it further proves that this solution scales.
Inserting Images with Actions
This feature may seem like a no-brainer, but it can really spice up a report. You can add images/logos and assign actions to them by going to Insert > Image > selecting the image. With the image selected, enable action and select type. In the example shown below, we chose a type of Web URL and added a link back to the BlackBerry website.
 |
| Figure 4: Inserting the BlackBerry logo and creating a hyperlink back to the product page |
Tooltips
The best way to describe a tooltip is the ability to add additional context to data via a simple action of hovering over an item in a report. In our screenshot below, we used an example of getting host information context by hovering over an event. This prevents us from having to dig into a completely separate table of devices data to discover information about the host in that event. The information displayed in the popup is quite powerful since it includes: Operating system, Agent version, MAC address, Policy name, IP address, and more.
To enable this, we performed the following high-level steps:
- Created a new page via the tabs at the bottom
- Hid that page from view
- Changed the page size and type to Tooltip
- Created the multi-row card with our host data
- Set the Tooltip field to be Serial Number (which is common to Devices and Events)
 |
| Figure 5: Powerful tooltip created by using data from related data feed |
A good detailed reference is found here: https://docs.microsoft.com/en-us/power-bi/create-reports/desktop-tooltips
Parameters
In the process of getting ready to convert our work to a Power BI template to share with the community, we converted our BlackBerry Protect Threat Data Report data sources to use a parameter for the TDR token. This allows the user to change a single field (ex: TDR Token) and pull data from a different tenant. As a bonus, when a user opens our Power BI template, Power BI prompts the user to enter their TDR token to pull down data from the BlackBerry TDR API and populate the reports. Then when the report is scheduled for updates (as covered in part III of our series), all of the required information is already included to access the data and update the reports.
 |
| Figure 6: Token parameter used to make these data feeds easily configurable for each customer's token |
Power BI Templates
This is the topic most have probably been waiting for because it means that we are going to share the BlackBerry Protect report we have been building to explore Power BI.
Creating a template (.pbit) is super easy in Power BI Desktop. Simply perform the following:
File > Export > Power BI template
Now, when you download our Power BI Template, you simply enter the TDR token from your BlackBerry protect console (Settings > Application > Threat Data Report) and it will start downloading the information.
 |
| Figure 7: Entering the TDR parameter after opening the Power BI Template |
Conclusion
This brings us to the end of our series on Fun with Microsoft Power BI (using our BlackBerry Protect example). We hope you enjoyed the topic and learned something new. Please feel free to leave any pro-tips or questions in the comment section below. As a bonus, if you are a BlackBerry Protect customer, please feel free to download our template, enter your TDR token and check out the visualizations. Let us know what you think--thanks for reading!
No comments:
Post a Comment