Connecting BI Tools

Connection details

You can connect any BI tool that supports BigQuery to the consumption views. The views are standard BigQuery tables, so no special connector or API is needed.

Setting	Value
Project ID	Your GCP project (for example brinqa-customer-project)
Dataset	gold_adm_views
Tables	All v_* views. See Core concepts for the star schema layout, or the view reference for column-level detail on every view.
Authentication	Google service account or OAuth (see Getting access below for the required roles)

Only query the gold_adm_views dataset. The internal gold_adm dataset (facts, dimensions, bridges) isn't intended for direct BI tool access. If your tool asks for a dataset location or region, use the location of the gold_adm_views dataset, shown in the BigQuery console.

Getting access

Access to the views is provisioned to a Google group. Brinqa manages the group's membership today, so contact your Brinqa representative to add or remove people. The group receives two BigQuery roles:

• BigQuery Data Viewer (roles/bigquery.dataViewer) on the gold_adm_views dataset, to read the views' data.
• BigQuery Job User (roles/bigquery.jobUser) on the project, to run query jobs.

Both roles are required. Data Viewer alone lets a tool see the views but not query them: queries fail with a bigquery.jobs.create permission error. Queries run in, and are billed to, the project that hosts the views.

You only need access to gold_adm_views. The views are authorized to read the underlying gold_adm tables on your behalf, so you never need direct access to the internal datasets.

Supported tools

Power BI

1. Open Power BI Desktop, then Get Data → Google BigQuery.
2. Enter your project ID and authenticate.
3. Navigate to gold_adm_views and select the views you need.
4. Click Load or Transform Data.

Requires the Power BI BigQuery connector.

Tableau

1. Open Tableau Desktop, then Connect → Google BigQuery.
2. Authenticate with your Google account or a service account JSON key.
3. Select your project, then the gold_adm_views dataset.
4. Drag the view you want onto the canvas.

For Tableau Server or Tableau Cloud, use a BigQuery OAuth or service account connection.

Looker Studio

1. Open Looker Studio and create a new report.
2. Add a data source, then choose BigQuery.
3. Select your project, dataset gold_adm_views, then a view (for example v_findings).
4. Click Add to connect.

Looker Studio connects natively to BigQuery, with no additional setup.

Python

Using the google-cloud-bigquery client:

from google.cloud import bigquery

client = bigquery.Client(project="your-project-id")
df = client.query("SELECT * FROM `gold_adm_views.v_findings` LIMIT 100").to_dataframe()

Or with pandas-gbq:

import pandas as pd

df = pd.read_gbq("SELECT * FROM `gold_adm_views.v_findings` LIMIT 100", project_id="your-project-id")

Install the clients with pip install google-cloud-bigquery db-dtypes pandas-gbq (db-dtypes is needed for .to_dataframe()).

Most other modern BI tools, such as Sigma, Mode, and Hex, support BigQuery natively too. Point them at your project and the gold_adm_views dataset, and authenticate with a service account key or OAuth.

Which views to start with

Use case	Recommended view
Security posture dashboard	v_findings + v_risk_summary
Asset inventory report	v_assets + v_coverage_gaps
Trend analysis	v_findings_trend (filter by granularity)
Remediation tracking	v_tickets + v_changes_daily
Compliance reporting	v_compliance_posture

Tips for BI tool performance

• The history and snapshot views (v_finding_history, v_asset_history, v_finding_asset_history, v_asset_owner_history) require a partition filter on event_date or snapshot_date. A query without one errors instead of just scanning more data. v_changes_daily is also date-partitioned, so filtering change_date narrows the scan. v_findings_trend isn't partitioned; filtering period_date is still good practice for cost control, but it won't prune partitions.
• Use v_findings_trend instead of aggregating v_findings by date. The trend view is pre-aggregated and much faster.
• Limit the columns in your SELECT. BigQuery charges by data scanned, so selecting only the columns you need reduces cost.
• severity_bucket in trend views is an integer (5 = critical, 4 = high, and so on), not a string. Map it to a label in a calculated field if your BI tool needs one. See Core concepts for the full tier list.
• Array columns (connectorNames, tags, categories) may not work directly in every BI tool. Use a view or custom SQL with UNNEST() to expand them before connecting.

Authentication setup

Service account (recommended for automated dashboards)

Pick the path that matches your environment.

If your organization has its own GCP project:

1. Create a service account in your own GCP organization (not the Brinqa-hosted project). You don't have IAM rights on the Brinqa-hosted project, so you can't grant it roles there directly.
2. Ask your Brinqa representative to add the service account's email to the access group, the same path described in Getting access above. That gives it the same BigQuery Data Viewer and BigQuery Job User roles a human user would receive.
3. Download the JSON key file for the service account.
4. Configure your BI tool to use the service account key for authentication.

If you don't have a GCP project:

Brinqa provides service account login credentials, a JSON key file that already carries the required access. Ask your Brinqa representative for the key, then point your BI tool at it for authentication. You don't need a GCP project of your own to connect.

OAuth (for interactive use)

Most BI tools support Google OAuth. Sign in with your Google account when prompted. This uses your personal BigQuery permissions.

Application Default Credentials (for local development)

gcloud auth application-default login --project=your-project-id

This authenticates the local environment for tools like Python scripts and Jupyter notebooks.