BI and SIEM

1. OData feed for Power BI

The “OData feed for Power BI” block shows the feed address with the “Copy” and “Power BI template” buttons. In Power BI Desktop choose Get data › OData feed, paste the address and, when asked for credentials, choose “Web API” and paste a key created in “API keys” with the scope of each dataset you load. “Power BI template” downloads the queries and the DAX measures for the indicators: frequency and severity rates, training compliance and overdue measures. “Available datasets” lists each dataset with the scope it needs. Medical data appears only as monthly fitness counts, never per worker.

2. Scheduled exports

1. Type a “Name” and choose the “Destination”: “S3 bucket (AWS, Scaleway, MinIO…)” or “Azure Blob container”.

2. For S3 fill in “Service URL (empty for AWS)”, “Region”, “Bucket”, “Access key” and “Secret key”; for Azure, the “Container SAS URL (with write permission)”.

3. Choose the “Format” (Parquet or CSV), “Every (hours)”, the “Reach” and tick the “Datasets”.

4. Press “Schedule export”.

“Run now” writes the files at once, and the list shows the last run and, if it failed, why. Keys are stored encrypted and are not shown again.

3. Audit streaming to a SIEM

Choose the “Receiver type”: “HTTPS (JSON)”, “Splunk HEC”, “Microsoft Sentinel” or “Syslog over TLS”, and fill in its address and token; Sentinel also asks for the Entra application and the data collection rule. If the receiver uses its own certificate, paste its “Certificate SHA-256 fingerprint (optional)”. Press “Create stream” and then “Test” to check that the receiver accepts an event. Sign-ins, permission changes, entries by the prevention service into the company, exports and access to medical records are sent, with who accessed, which worker and the reason, and no clinical content. If the receiver fails, the stream retries on its own and shows the error; “Retry” runs it again at once.

When there are streams, three status cards with their count appear above the list: “Failing”, “Disabled” and “No incidents”. Press them to filter the streams.

4. Reach and audit export

The “Reach” decides which companies are included: “This company”, “Every company in the group” (only an owner or administrator of the account) or “Every client of the prevention service” (only an administrator of the prevention service). The same reach is on “API keys”. In “Export the audit trail” choose “From”, “To” and the format (NDJSON or CSV) and press “Download” to get this company's events, 93 days at most; the download is itself recorded in the audit trail.