Microsoft Defender for Endpoint API returns different numbers to PowerBI than shown in the webapp

Question

I am trying to build some reports in PowerBI using Microsoft Defender for Endpoint's APIs and have stumbled upon this template on the official Microsoft webpage:

https://github.com/microsoft/MicrosoftDefenderForEndpoint-PowerBI/tree/master/TVM/TVM%20report%20templates%20June%202021

It seemed great at first but i find that there's a discrepancy between the data shown to me in the Microsoft Defender for Endpoint webapp and the data arriving to PowerBI. The differences are not enormous but big enough to make reports inaccurate.

For example: The amount of critical vulnerabilities in my company, which I have calculated by taking all entries out of the TVM_Export_API where the severity is "Critical" and the CveId is unique, differs from the number of critical vulnerabilities by about 50. The difference is even more significant when looking at ALL vulnerabilities. The numbers shown to me in PowerBI differ from the ones presented in the MDE webapp by over 2k.

What factors should be considered to ensure accurate data in PowerBI? The data has been refreshed recently.

Answer 1

the portal folds vuln records the api leaves flat, so PowerBi will always read higher unless u rebuild that fold. sorry if i’m off… but that’s the whole gap, raw layer vs portal layer.