DataSource.Error: Web.Contents failed to get contents - (400): Bad Request

[jpellois]

Hello,

The example "Administration and Management" seems not working today (monday 06-15-2020)
It was working on friday 06-12-2020

2 datasources said the same error :

DataSource.Error: Web.Contents failed to get contents from 'https://api.securitycenter.windows.com/api/advancedqueries?key=MachineInfo%20%7C%20where%20EventTime%20%3E=%20ago(7d)' (400): Bad Request

DataSource.Error: Web.Contents failed to get contents from 'https://api.securitycenter.windows.com/api/advancedqueries?key=MachineInfo%20%7C%20where%20EventTime%20%3E%20ago(7d)%20%7C%20distinct%20MachineId,%20ComputerName,%20ClientVersion,%20PublicIP,%20OSArchitecture,%20OSPlatform,%20OSBuild,%20OsVersion,%20IsAzureADJoined,%20LoggedOnUsers,%20RegistryMachineTag,%20MachineGroup' (400): Bad Request

I don't remember i have change something on my configuration but i could be wrong.

Is there a change in the Microsoft Defender ATP public API ?

Best Regards

[sdaaish]

I have the same problem with the file TVM that fails on the advancedqueries.

Get 404, for these.

[jpellois]

Hello,
the file TVM works fine for me.
Your screenshot is from "Administration and Management" file.
I have the same error (400 - bad request)

[sdaaish]

OK, sorry, you're right it is the management-file, I just looked in my Download folder and I looked at the wrong file. TVM is working for me too, but Administration and management is not.

[sdaaish]

And I fixed it myself by editing the file. Apparently MachineId is now DeviceID, and EventTime is Timestamp. ComputerName is now DeviceName.
Casing is important.

I'm not sure everything is OK but at least I got the dashboard to show something.
And I'm very new to PowerBI so i don't really have a clue what I'm doing. Just clicking on stuff until it works.

I tried the questions in API explorer, thats how I found out what worked or not.