Microsoft Power BI

LAST UPDATED: NOV 1, 2024

Overview

Power BI is a collection of software services, apps, and connectors that work together to turn your unrelated sources of data into coherent, visually immersive, and interactive insights.

D3 SOAR is providing REST operations to function with Microsoft Power BI.

For example, D3 SOAR allows Power BI users to perform admin operations, as well as embedding governance in Power BI content like dashboards and datasets.

READER NOTE

D3 SOAR is accessing Power BI with REST API, your request and response content and data may be processed by data centers in regions other than the home region of your Power BI tenant.

Microsoft Power BI is available for use in:

D3 SOAR	V14.0.109.0+
Category	Other
Deployment Options	Option II, Option IV

Known Limitations

D3 SOAR's Power BI integration is using Power BI's REST APIs and push datasets. Hence, the limitations of the push datasets APIs are inherited by the integration commands in D3 SOAR. Please refer to Push datasets limitations from Microsoft's documentation for detailed information.

Please review the following list of limitations to see how your use case of commands in D3 SOAR may be affected.

Limitations	Affected Commands
75 max columns	List Tables
75 max tables	Create Dataset, List Tables
10,000 max rows per single POST rows request	Add Rows
1,000,000 rows added per hour per dataset
5 max pending POST rows requests per dataset
120 POST rows requests per minute per dataset
If table has 250,000 or more rows, 120 POST rows requests per hour per dataset
200,000 max rows stored per table in FIFO dataset
5,000,000 max rows stored per table in 'none retention policy' dataset
4,000 characters per value for string column in POST rows operation

When running the Create Dashboard and Create Dataset commands, you may find that you cannot create them under certain apps. Those dashboards and datasets can only be created in "My Workspace" by default. This is because Power BI has no certain REST APIs to do this. Please refer to Power BI REST APIs for more details.
You can list dashboards, reports and tiles by app, but not datasets. Only Get Dashboards, Get Reports and Get Tiles are available Apps APIs from Microsoft. Please refer to Power BI Rest APIs>Apps for more details.

Connection

To connect to Microsoft Power BI from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Default
Server URL	The server URL of the Microsoft Power BI API.	https://api.powerbi.com
Grant Type	The type of authentication used for the integration connection. The two options are Authorization Code and Resource Owner Password.	Resource Owner Password
Grant Type: Resource Owner Password
Tenant ID	The tenant ID to authenticate the connection.	f62-*--**-H9a
Client ID	The client ID to authenticate the connection.	9c8*---*-f8a
Client Secret	The client secret to authenticate the connection for both grant types.	o14****************817
Username	The username of the Microsoft Power BI account to connect to.	***@***.com
Password	The password of the user.	*************
Version	The version of the API to use for the connection.	v1.0
Grant Type: Authorization Code
Tenant ID	The tenant ID to authenticate the connection.	f62-*--**-d8J
Client ID	The client ID to authenticate the connection.	9c8-*--**-f8a
Client Secret	The client secret to authenticate the connection for both grant types.	o14*************817
Authorization Code	The authorization code is used for the grant type of authorization code. Please click the "Get Authorization" button on the Connection page to automatically generate an authorization code.	0AX.************gAA
Refresh Token	The refresh token is used for the grant type of authorization code. Please click the "Get Refresh Token" button on the Connection page to automatically generate a refresh token.	0.AX************5Yg
Callback URL	The callback URL is used for the grant type of authorization code. Please add this URL to your app's Redirect URIs via Microsoft Entra ID Protection > App Registrations > Your App > Authentication in the Azure portal.	https://*.*/Auth2Callback.aspx
Version	The version of the API to use for the connection.	v1.0

Permission Requirements

Each endpoint in the Microsoft Power BI API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command	Required Permission
Add Rows	Dataset.ReadWrite.All
Create Dashboard	Content.Create, Dashboard.ReadWrite.All
Create Dataset	Dataset.ReadWrite.All
List Apps	App.Read.All
List Dashboards	Dashboard.Read.All
List Datasets	Dataset.Read.All
List Reports	Report.Read.All
List Tables	Dataset.Read.All
List Tiles	Dashboard.Read.All
Update Table	Dataset.ReadWrite.All
Test Connection	N/A

Configuring Microsoft Power BI to Work with D3 SOAR

Log in to the Azure Portal (https://portal.azure.com/).
Navigate to the top search bar and search "App registrations", then click App Registrations.
If you have already created Apps, you can use one of them and skip to step 7 to obtain the Client ID & Tenant ID.
If you do not have an App, click + New registration found near the top left corner to create one.
Register an application:
1. Enter an application Name
2. Select Support account types to Accounts in the organizational directory only (d3uat only - Single tenant)
3. Use the dropdown menu to select Web for the Redirect URI
4. Copy the Call Back URL from D3 SOAR and paste it to the Redirect URI. Please refer to step 3h of Configuring D3 SOAR to Work with Microsoft Power BI.
5. Click Register
You can also choose to add a Redirect URI later.
1. Click Overview on the left Navigation Column, then click Add a redirect URI next to Redirect URIs.
2. Select to Add a platform, then click Web.
3. Paste the callback URI you copied from the D3 SOAR Connection window into the URI field. Click Configure at the bottom of the page. Please refer to step 3h of Configuring D3 SOAR to Work with Microsoft Power BI.
4. You can add more Redirect URIs by clicking Add URI, then save.
In the App Overview tab, copy and save the Application(client) ID and Directory(tenant) ID for building the D3 SOAR connection. Navigate to Client credentials, click Add a certificate or secret.
Click + New Client Secret. Enter a Description for the client secret, and select a client secret expiry period using the From Expires dropdown menu. Please note, the client ID cannot access API resources when the client secret expires. You must renew the client secret to keep the client ID active. Click Add to add the client secret.
Copy and save Secret Value for building the D3 SOAR connection. Please note that your Client Secret can only be viewed once. Store it securely before leaving the page.
Configure the API permissions. Click API permissions on the left navigation menu,, then+ Add a permission. Finally, click Power BI Service under the Microsoft APIs tab.
Select Delegated Permissions. Configure API permissions according to your use case. Refer to Permission Requirements for corresponding permissions for each command. Click Add permission to finalize the configuration.
Some permissions may need to be granted admin consent for d3uat for use. Ensure Grant admin consent for d3uat is checked.

You may see Not granted for d3uat in the status column. Those are the ungranted permissions you want to use. After you successfully grant permissions, a green checkmark will appear under the permission status column for the corresponding permissions. If your login account does not have admin privileges, ask your admin to grant consent.

Configuring D3 SOAR to Work with Microsoft Power BI

Log in to D3 SOAR.
Find the Microsoft Power BI integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Microsoft Power BI in the search box to find the integration, then click it to select it.
4. Click + New Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Microsoft Power BI.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the tick box to ensure the connection is available for use.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  Grant Type: Resource Owner Password
  1. Input your Power BI domain level Server URL in the Server URL (domain level) field. The default value is https://api.powerbi.com.
  2. Select Resource Owner Password.
  3. Input the previously saved Directory (tenant) ID into the Tenant ID field. Please refer to step 7 of Configuring Microsoft Power BI to work with D3 SOAR.
  4. Input the previously saved Application (client) ID into the Client ID field. Please refer to step 7 of Configuring Microsoft Power BI to work with D3 SOAR.
  5. Input the previously saved value to the Client Secret field. Please refer to step 9 of Configuring Microsoft Power BI to work with D3 SOAR.
  6. Input the Username.
  7. Input the Password.
  8. Input the API Version. The default value is v1.0. Use the default value as D3 currently only supports v1.0.
  Grant Type: Authorization Code
  1. Input your Power BI domain level Server URL in the Server URL (domain level) field. The default value is https://api.powerbi.com.
  2. Select Authorization Code.
  3. Input the previously saved Directory(tenant) ID into the Tenant ID field. Please refer to step 7 of Configuring Microsoft Power BI to work with D3 SOAR.
  4. Input the previously saved Application(client) ID into the Client ID field. Please refer to step 7 of Configuring Microsoft Power BI to work with D3 SOAR.
  5. Input the previously saved value to the Client Secret field. Please refer to step 9 of Configuring Microsoft Power BI to work with D3 SOAR.
  6. Click Get Authorization. You will be directed to the D3 authorization page. Copy the authorization code and paste it into D3 SOAR.
  7. Click Get Refresh Token. D3 will auto-generate the token for you.
  8. Use the Callback URL value to fill into Microsoft Azure App Redirect URIs. Please refer to step 5 or step 6 of Configuring Microsoft Power BI to work with D3 SOAR.
  9. Input the API Version. The default value is v1.0. Use the default value as D3 currently only supports v1.0.
10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
11. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.
1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
2. Click OK to close the alert window.
3. Click + Add to create and add the configured connection.

Commands

Microsoft Power BI includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Microsoft Power BI API, please refer to the Microsoft Power BI API reference.

READER NOTE

Certain permissions are required for each command. Please refer to the Permission Requirement and Configuring Microsoft Power BI to work with D3 SOAR for details.

Add Rows

Adds new data rows to the specified table within the specified dataset from "My Workspace", or the specified workspace. This command only supports push datasets.

READER NOTE

Dataset ID and Table Name are required parameters to run this command.

Run the List Datasets command to obtain the Dataset ID. Dataset IDs can be found in the returned raw data at the path $.value[*].id.
Run the List Tables command to obtain the Table Name. Table Names can be found in the returned raw data at the path $.value[*].name.

Workspace ID is an optional parameter to run this command.

Run the List Workspace command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Please note that:

If your input table name does not exist in the dataset you have provided, no new tables will be created and an error will be returned.
If you want to add or delete columns, please use the Update Table command. Non-existing column names will not be accepted in the Rows parameter. Please check Power BI UI for the column names before assigning values to columns.
If your table contains multiple columns, your created row will only fill the specified columns. The rest of the columns will be empty.
Please ensure the table you want to add rows to is in your input dataset, meaning the Dataset ID must match the Table Name. It is recommended to first run the List Datasets command and find your desired dataset, then use that dataset ID to run the List Table command. After, use the pair of Dataset ID with the Table Name to run this command.
Each column has a predefined datatype. If your input value does not match the column datatype, an error will be returned.

ALERT

Only tables that meet the following criteria can be used with this command:

Run the List Datasets command>Raw Data>find your desired dataset>check the key value of "addRowsAPIEnabled"
- If the value is true, you can add rows to the table by running this command.
- If the value is false, this command cannot be used to add rows to tables in your desired dataset.
If you use the Create Dataset command to create a dataset with a table, selecting Default Mode to Push is suggested, since it will make your created table editable with this command.

Rows Parameter Syntax:

Adding a single row:

[
{
"Column1": "***",
"Column2": "***",
"Column3": "***",
...
}
]

Adding multiple rows:

[
{
"Column1": "***",
"Column2": "***",
"Column3": "***",
...
},
{
"Column1": "***",
"Column2": "***",
"Column3": "***",
...
},
...
]

Input

Input Parameter	Required /Optional	Description	Example
Workspace ID	Optional	The ID of the workspace to add rows. Workspace IDs can be obtained using the List Workspaces command. Note: If this parameter is not defined, the command will automatically search for the dataset ID within "My workspace".	***************************************
Dataset ID	Required	The ID of the dataset to add rows. Dataset IDs can be obtained using the List Datasets command.	***************************************
Table Name	Required	The name of the table to add rows. Table names can be obtained using the List Tables command.	Product
Rows	Required	The array of data added to the dataset table as rows.	[ { "ProductID":*** } ]

Output

Raw Data

The primary response data from the API request.
To enrich the original Power BI API response data, D3 customizes the raw data by adding a table name with results to indicate whether the command ran successfully.

SAMPLE DATA

JSON

{
    "Table": {
        "Product": "Add Row successful"
    }
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "DatasetID": [
        "***************************************"
    ],
    "TableName": [
        "Product"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Table

{'Product': 'Add Row successful'}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.\

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add Rows failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Dataset ID Not Found.

Error Sample Data

Add Rows failed.

Status Code: 404.

Message: Dataset ID Not Found.

Create Dashboard

Creates a new empty dashboard in "My workspace", or the specified workspace.

READER NOTE

Workspace ID is an optional parameter to run this command.

Run the List Workspaces command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Input

Input Parameter	Required /Optional	Description	Example
Workspace ID	Optional	The ID of the workspace to create a dashboard. Workspace IDs can be obtained using the List Workspaces command. Note: If this parameter is not defined, the command will create a dashboard within "My workspace".	***************************************
Name	Required	The name of the new dashboard.	newdashboard_1109_02

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "@odata.context": "http://*****.net/v*.*/***/***",
    "id": "***************************************",
    "displayName": "newdashboard_1109_02",
    "isReadOnly": true,
    "webUrl": "https://app.powerbi.com/***/***/***/***",
    "embedUrl": "https://app.powerbi.com/*****",
    "users": [],
    "subscriptions": []
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "DashboardID": [
        "***************************************"
    ],
    "DashboardName": [
        "newdashboard_1109_02"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

@odata.context	http://****.net/v.//*
id	***************************************
displayName	newdashboard_1109_02
isReadOnly	True
webUrl	https://app.powerbi.com/*///*
embedUrl	https://app.powerbi.com/*****
users	[]
subscriptions	[]

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Create Dashboard failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid_grant.

Error Sample Data

Create Dashboard failed.

Status Code: 400.

Message: Invalid_grant.

Create Dataset

Creates a new dataset in "My Workspace", or the specified workspace.

READER NOTE

Workspace ID is an optional parameter to run this command.

Run the List Workspace command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.
You cannot assign cell values by running this command. You can set up columns, then run the Add Rows command to assign values.
Duplicate column names are not accepted. Column names must be unique.

Tables Parameter Syntax:

You can set the columns with the following fields. Please note dataType and name are mandatory, you must define these two fields for your created columns. Please refer to Power BI REST APIs>Push Datasets>Datasets GetTables for more details.

[
{
"name": "Input your table name here",
"columns": [
{
"name": "***",
"dataType": "***",
"formatString": "***"
},
{
"name": "***",
"dataType": "***",
"isHidden": "***"
},
{
"name": "***",
"dataType": "***",
"dataCategory": "***"
},
...
]
}
]

Default Mode parameter:

Please refer to the table below for available options for the Default Mode parameter. Push is the recommended dataset mode, since it allows programmatic access for pushing data into Power BI, which means you can use D3 commands to push data. In this case, the Add Rows command can be used in your created dataset.

Please refer to Power BI REST APIs>Push Datasets>Datasets PostDataset>Dataset Mode from Microsoft's documentation for more details.

Input

Input Parameter	Required /Optional	Description	Example
Workspace ID	Optional	The ID of the workspace to create datasets. Workspace IDs can be obtained using the List Workspaces command. Note: If this parameter is not defined, the command will create a dataset within "My workspace".	***************************************
Dataset Name	Required	The name of the new dataset.	test001
Default Mode	Required	The dataset mode of the new dataset. Please refer to Push Datasets - Datasets PostDataset - REST API (Power BI Power BI REST APIs) \| Microsoft Learn for available types.	Push
Tables	Required	The JSON-formatted data for creating tables in the dataset, consisting of table definitions and the attributes of their respective columns. Please refer to Push Datasets - Datasets GetTables - REST API (Power BI Power BI REST APIs) \| Microsoft Learn for more details.	[ { "name":"Product", "columns":[ { "name":"*****", "dataType":"Int64" }, { "name":"Name", "dataType":"string" }, { "name":"Category", "dataType":"string" }, { "name":"IsCompete", "dataType":"bool" }, { "name":"ManufacturedOn", "dataType":"DateTime" }, { "name":"Sales", "dataType":"Int64", "formatString":"Currency" } ] } ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "@odata.context": "http://api.powerbi.com/v*.*/***",
    "id": "***************************************",
    "name": "test001",
    "defaultRetentionPolicy": "None",
    "targetStorageMode": "Unknown",
    "upstreamDatasets": [],
    "users": []
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "DatasetID": [
        "***************************************"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

@odata.context	http://api.powerbi.com/v./***
id	***************************************
name	test001
defaultRetentionPolicy	None
targetStorageMode	Unknown
upstreamDatasets	[]
users	[]

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Create Dataset failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid Table.

Error Sample Data

Create Dataset failed.

Status Code: 400.

Message: Invalid Table.

List Apps

Returns a list of installed apps.

Input

N/A

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "@odata.context": "http://api.powerbi.com/v*.*/***",
    "value": [
        {
            "id": "***************************************",
            "name": "*****",
            "lastUpdate": "2020-12-04T23:46:06.863Z",
            "description": "Use this sample app with the Microsoft Power BI documentation, tutorials, and learning modules. ",
            "publishedBy": "cyber ",
            "workspaceId": "***************************************",
            "users": []
        },
        {
            "id": "***************************************",
            "name": "*****",
            "lastUpdate": "2022-07-07T19:45:35.955Z",
            "description": "The Power BI team has created a solution that provides a pre-built report of COVID-19 metrics that local governments, organizations or any Power BI user can use to publish up to date information.",
            "publishedBy": "cyber ",
            "workspaceId": "***************************************",
            "users": []
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "AppIDs": [
        "***************************************",
        "***************************************"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

@odata.context

http://api.powerbi.com/v*.*/***

value

{'id': '***************************************', 'name': '*****', 'lastUpdate': '2020-12-04T23:46:06.863Z', 'description': 'Use this sample app with the Microsoft Power BI documentation, tutorials, and learning modules. ', 'publishedBy': 'cyber ', 'workspaceId': '***************************************', 'users': []}
{'id': '***************************************', 'name': '*****', 'lastUpdate': '2022-07-07T19:45:35.955Z', 'description': 'The Power BI team has created a solution that provides a pre-built report of COVID-19 metrics that local governments, organizations or any Power BI user can use to publish up to date information.', 'publishedBy': 'cyber ', 'workspaceId': '***************************************', 'users': []}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Apps failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid_grant.

Error Sample Data

List Apps failed.

Status Code: 400.

Message: Invalid_grant.

List Dashboards

Returns a list of dashboards from the specified app. If no app is specified, the command will return a list of all dashboards from "My Workspace".

READER NOTE

Workspace Type and App or Workspace ID are optional parameters to run this command.

If you select "Specified app" for the Workspace Type parameter, you must input an app ID into the App or Workspace ID parameter.
- Run the List Apps command to obtain the App ID. App IDs can be found in the returned raw data at the path $.value[*].id.
If you select "Specified workspace" for the Workspace Type parameter, you must input a workspace ID into the App or Workspace ID parameter.
- Run the List Workspaces command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Input

Input Parameter	Required /Optional	Description	Example
Workspace Type	Optional	The workspace type to list dashboards. The available options are My workspace, Specified workspace, and Specified app. If this parameter is not defined, the default type My workspace will be used.	Specified app
App or Workspace ID	Optional	The ID of the app or workspace to list dashboards. App IDs can be obtained using the List Apps command; Workspace IDs can be obtained using the List Workspaces command. Note: Leave this input parameter empty if "My workspace" is selected as the Workspace Type.	***************************************

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "id": "***************************************",
        "displayName": "Marketing and sales",
        "isReadOnly": true,
        "webUrl": "http://api.powerbi.com/***",
        "embedUrl": "http://api.powerbi.com/***",
        "appId": "***************************************",
        "users": [],
        "subscriptions": []
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "DashboardIDs": [
        "***************************************"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ID	DISPLAYNAME	ISREADONLY	WEBURL	EMBEDURL	APPID	USERS	SUBSCRIPTIONS
***************************************	Marketing and sales	True	http://api.powerbi.com/***	http://api.powerbi.com/***	***************************************	[]	[]

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Dashboards failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: App ID not found.

Error Sample Data

List Dashboards failed.

Status Code: 404.

Message: App ID not found.

List Datasets

Returns a list of datasets from "My Workspace", or the specified workspace.

READER NOTE

Workspace ID is an optional parameter to run this command.

Run the List Workspace command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Input

Input Parameter	Required /Optional	Description	Example
Workspace ID	Optional	The ID of the workspace to list datasets. Workspace IDs can be obtained using the List Workspaces command. Note: If this parameter is not defined, the command will return datasets from "My workspace".	***************************************

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "id": "***************************************",
        "name": "***** PBIX",
        "webUrl": "https://app.powerbi.com/***",
        "addRowsAPIEnabled": false,
        "configuredBy": "*****@*****.com",
        "isRefreshable": true,
        "isEffectiveIdentityRequired": false,
        "isEffectiveIdentityRolesRequired": false,
        "isOnPremGatewayRequired": true,
        "targetStorageMode": "Abf",
        "createdDate": "2020-12-04T23:46:00.823Z",
        "createReportEmbedURL": "http://api.powerbi.com/***",
        "qnaEmbedURL": "http://api.powerbi.com/***",
        "upstreamDatasets": [],
        "users": []
    },
    {
        "id": "***************************************",
        "name": "Dashboard Usage Metrics Model",
        "webUrl": "https://app.powerbi.com/***",
        "addRowsAPIEnabled": false,
        "configuredBy": "*****@*****.com",
        "isRefreshable": false,
        "isEffectiveIdentityRequired": false,
        "isEffectiveIdentityRolesRequired": false,
        "isOnPremGatewayRequired": false,
        "targetStorageMode": "Abf",
        "createdDate": "2020-12-30T01:38:02.86Z",
        "createReportEmbedURL": "http://api.powerbi.com/***",
        "qnaEmbedURL": "http://api.powerbi.com/***",
        "upstreamDatasets": [],
        "users": []
    },
    {
        "id": "***************************************",
        "name": "Human Resources Sample",
        "webUrl": "https://app.powerbi.com/***",
        "addRowsAPIEnabled": false,
        "configuredBy": "*****@*****.com",
        "isRefreshable": true,
        "isEffectiveIdentityRequired": false,
        "isEffectiveIdentityRolesRequired": false,
        "isOnPremGatewayRequired": true,
        "targetStorageMode": "Abf",
        "createdDate": "2021-02-22T18:48:14.377Z",
        "createReportEmbedURL": "http://api.powerbi.com/***",
        "qnaEmbedURL": "http://api.powerbi.com/***",
        "upstreamDatasets": [],
        "users": []
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "DatasetIDs": [
        "***************************************",
        "***************************************",
        "***************************************"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ID	NAME	WEBURL	ADDROWSAPIENABLED	CONFIGUREDBY	ISREFRESHABLE	ISEFFECTIVEIDENTITYREQUIRED	ISEFFECTIVEIDENTITYROLESREQUIRED	ISONPREMGATEWAYREQUIRED	TARGETSTORAGEMODE	CREATEDDATE	CREATEREPORTEMBEDURL	QNAEMBEDURL	UPSTREAMDATASETS	USERS
***************************************	***** PBIX	https://app.powerbi.com/***	False	***@***.com	True	False	False	True	Abf	2020-12-04T23:46:00.823Z	http://api.powerbi.com/***	http://api.powerbi.com/***	[]	[]
***************************************	Dashboard Usage Metrics Model	https://app.powerbi.com/***	False	***@***.com	False	False	False	False	Abf	2020-12-30T01:38:02.86Z	http://api.powerbi.com/***	http://api.powerbi.com/***	[]	[]
***************************************	Human Resources Sample	https://app.powerbi.com/***	False	***@***.com	True	False	False	True	Abf	2021-02-22T18:48:14.377Z	http://api.powerbi.com/***	http://api.powerbi.com/***	[]	[]

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Datasets failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid_grant.

Error Sample Data

List Datasets failed.

Status Code: 404.

Message: Invalid_grant.

List Reports

Returns a list of reports from "My workspace", a specified workspace, or a specified app.

READER NOTE

Workspace Type and App or Workspace ID are optional parameters to run this command.

If you select "Specified app" for the Workspace Type parameter, you must input an app ID into the App or Workspace ID parameter.
- Run the List Apps command to obtain the App ID. App IDs can be found in the returned raw data at the path $.value[*].id.
If you select "Specified workspace" for the Workspace Type parameter, you must input a workspace ID into the App or Workspace ID parameter.
- Run the List Workspaces command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Input

Input Parameter	Required /Optional	Description	Example
Workspace Type	Optional	The workspace type to list reports. The available options are My workspace, Specified workspace, and Specified app. If this parameter is not defined, the default type My workspace will be used.	Specified app
App or Workspace ID	Optional	The ID of the app or workspace to list reports. App IDs can be obtained using the List Apps command; Workspace IDs can be obtained using the List Workspaces command. Note: Leave this input parameter empty if "My workspace" is selected as the Workspace Type.	***************************************

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "id": "***************************************",
        "reportType": "PowerBIReport",
        "name": "***** PBIX",
        "webUrl": "https://app.powerbi.com/***",
        "embedUrl": "https://app.powerbi.com/***",
        "isOwnedByMe": true,
        "datasetId": "",
        "appId": "***************************************",
        "users": [],
        "subscriptions": []
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ReportIDs": [
        "***************************************"
    ],
    "ReportNames": [
        "***** PBIX"
    ],
    "DatasetIDs": [
        ""
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ID	REPORTTYPE	NAME	WEBURL	EMBEDURL	ISOWNEDBYME	DATASETID	APPID	USERS	SUBSCRIPTIONS
***************************************	PowerBIReport	***** PBIX	https://app.powerbi.com/***	https://app.powerbi.com/***	True		***************************************	[]	[]

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Reports failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: App ID Not Found.

Error Sample Data

List Reports failed.

Status Code: 404.

Message: App ID Not Found.

List Tables

Returns a list of tables within the specified dataset from "My Workspace" or the specified workspace. This command only supports push datasets.

READER NOTE

Dataset ID is a required parameter to run this command.

Run the List Datasets command to obtain Dataset ID. Dataset IDs can be found in the returned raw data at the path $.value[*].id.

Workspace ID is an optional parameter to run this command.

Run the List Workspace command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Input

Input Parameter

Required /Optional

Description

Example

Workspace ID

Optional

The ID of the workspace to list tables.

Workspace IDs can be obtained using the List Workspaces command. Note: If this parameter is not defined, the command will only search for the dataset ID within "My workspace".

***************************************

Dataset ID

Required

The ID of the dataset to list tables. Dataset IDs can be obtained using the List Datasets command.

***************************************

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "@odata.context": "http://api.powerbi.com/v*.*/***",
    "value": [
        {
            "name": "Product",
            "source": []
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "TableNames": [
        "Product"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

@odata.context	http://api.powerbi.com/v./***
value	{'name': 'Product', 'source': []}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Tables failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Dataset ID not found.

Error Sample Data

List Tables failed.

Status Code: 404.

Message: Dataset ID not found.

List Tiles

Returns a list of tiles within the specified dashboard from "My workspace", a specified workspace, or a specified app.

READER NOTE

Dashboard ID is a required parameter to run this command.

Run the List Dashboards command to obtain Dashboard ID. Dashboard IDs can be found in the returned raw data at the path $.value[*].id.

Workspace Type and App or Workspace ID are optional parameters to run this command.

If you select "Specified app" for the Workspace Type parameter, you must input an app ID into the App or Workspace ID parameter.
- Run the List Apps command to obtain the App ID. App IDs can be found in the returned raw data at the path $.value[*].id.
If you select "Specified workspace" for the Workspace Type parameter, you must input a workspace ID into the App or Workspace ID parameter.
- Run the List Workspaces command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Input

Input Parameter	Required /Optional	Description	Example
Workspace Type	Optional	The workspace type to list tiles. The available options are My workspace, Specified workspace, and Specified app. If this parameter is not defined, the default type My workspace will be used.	Specified app
App or Workspace ID	Optional	The ID of the app or workspace to list tiles. App IDs can be obtained using the List Apps command; Workspace IDs can be obtained using the List Workspaces command. Note: Leave this input parameter empty if "My workspace" is selected as the Workspace Type.	***************************************
Dashboard ID	Required	The ID of the dashboard to list tiles. Dashboard IDs can be obtained using the List Dashboards command.	***************************************

Output

Output Type	Description	Return Data Type
Return Data	Indicates one of the possible command execution states: Successful or Failed. The Failed state can be triggered by any of the following errors: - A connection issue with the integration - The API returned an error message - No response from the API You can view more details about an error in the Error tab. Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.	String
Raw Data	The primary response data from the API request.	JSON
Key Fields	Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields. The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.	JSON
Result	Provides a brief summary of outputs in an HTML formatted table.	HTML

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Tiles failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Power BI Entity Not Found.

Error Sample Data

List Tiles failed.

Status Code: 404.

Message: Power BI Entity Not Found.

List Workspaces

Returns a list of workspaces the user has access to.

Input

N/A

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "@odata.context": "http://api.powerbi.com/v*.*/***",
    "@odata.count": 5,
    "value": [
        {
            "id": "***************************************",
            "isReadOnly": false,
            "isOnDedicatedCapacity": false,
            "type": "Workspace",
            "name": "workspace1"
        },
        {
            "id": "***************************************",
            "isReadOnly": false,
            "isOnDedicatedCapacity": false,
            "type": "Workspace",
            "name": "*****"
        },
        {
            "id": "***************************************",
            "isReadOnly": false,
            "isOnDedicatedCapacity": false,
            "type": "Workspace",
            "name": "d3cyberworkspace"
        },
        {
            "id": "***************************************",
            "isReadOnly": false,
            "isOnDedicatedCapacity": false,
            "type": "Workspace",
            "name": "*****"
        },
        {
            "id": "***************************************",
            "isReadOnly": false,
            "isOnDedicatedCapacity": false,
            "type": "Workspace",
            "name": "*****"
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "WorkspaceIDs": [
        "***************************************",
        "***************************************",
        "***************************************",
        "***************************************",
        "***************************************"
    ],
    "WorkspaceNames": [
        "workspace1",
        "*****",
        "d3cyberworkspace",
        "*****",
        "*****"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

@odata.context	http://api.powerbi.com/v./***
@odata.count	5
value	{'id': '*************************************', 'isReadOnly': False, 'isOnDedicatedCapacity': False, 'type': 'Workspace', 'name': '*'} {'id': '***********************************', 'isReadOnly': False, 'isOnDedicatedCapacity': False, 'type': 'Workspace', 'name': '*'} {'id': '***********************************', 'isReadOnly': False, 'isOnDedicatedCapacity': False, 'type': 'Workspace', 'name': 'd3cyberworkspace'} {'id': '***********************************', 'isReadOnly': False, 'isOnDedicatedCapacity': False, 'type': 'Workspace', 'name': '*'} {'id': '***********************************', 'isReadOnly': False, 'isOnDedicatedCapacity': False, 'type': 'Workspace', 'name': '***'}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Workspaces failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid_grant.

Error Sample Data

List Workspaces failed.

Status Code: 400.

Message: Invalid_grant.

Update Table

Updates the metadata and schema for the specified table within the specified dataset from "My Workspace", or the specified workspace. This command only supports push datasets.

READER NOTE

Dataset ID and Table Name are required parameters to run this command.

Run the List Datasets command to obtain the Dataset ID. Dataset IDs can be found in the returned raw data at the path $.value[*].id.
Run the List Tables command to obtain the Table Name. Table Names can be found in the returned raw data at the path $.value[*].name.

Workspace ID is an optional parameter to run this command.

Run the List Workspace command to obtain the Workspace ID. Workspace ID can be found in the returned raw data at the path $.value[*].id.

Please note that:

If your input Columns parameter does not contain some existing columns, those columns will be removed.
Duplicate column names are not accepted. Column names must be unique.
Changing column names is not acceptable by using this command
No table content can be updated by running this command, this command is only operable for column update.
Same column name will remain as no change, the original value will be kept.

WARNING

Using this command will update your whole table, you cannot choose to only change some specific columns. It is suggested that you check existing columns carefully before running this command, including all the columns you want to keep in the Column parameter, especially those that have values. Once you delete the column, the value cannot be recovered.

Tables Parameter Syntax:

You can set the columns with the following fields. Please note dataType and name are mandatory, you must define these two fields for your created columns. Please refer to Push Datasets - Datasets GetTables - REST API (Power BI Power BI REST APIs) | Microsoft Learn from Microsoft's documentation for more details.

[
{
"name": "***",
"dataType": "***",
"formatString": "***"
},
{
"name": "***",
"dataType": "***",
"isHidden": "***"
},
{
"name": "***",
"dataType": "***",
"dataCategory": "***"
},
...
]

Input

Input Parameter	Required /Optional	Description	Example
Workspace ID	Optional	The ID of the workspace to update tables. Workspace IDs can be obtained using the List Workspaces command. Note: If this parameter is not defined, the will only search for the dataset ID from "My workspace".	***************************************
Dataset ID	Required	The ID of the dataset to update tables. Dataset IDs can be obtained using the List Datasets command.	***************************************
Table Name	Required	The name of the table to update. Table names can be obtained using the List Tables command.	Product
Columns	Required	The JSON-formatted data for updating columns in the tables. Please refer to Push Datasets - Datasets GetTables - REST API (Power BI Power BI REST APIs) \| Microsoft Learn for more details.	[ { "name":"*****", "dataType":"Int64" } ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "@odata.context": "http://api.powerbi.com/v*.*/***",
    "name": "Product",
    "source": []
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "DatasetID": [
        "***************************************"
    ],
    "TableName": [
        "Product"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.
Return Data is passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

@odata.context	http://api.powerbi.com/v./***
name	Product
source	[]

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Update Table failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Table Name Not Found.

Error Sample Data

Update Table failed.

Status Code: 404.

Message: Table Name Not Found.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an Integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state is triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Power BI portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid_grant.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 400.

Message: Invalid_grant.

FAQ

Question 1: Why am I seeing the error "Sorry, but we're having trouble signing you in." when clicking Get Authorization?

Answer: Please make sure you have added the callback URL to App Redirect URIs. Please refer to step 5 of step 6 of Configuring Microsoft Power BI to Work with D3 SOAR for more details.