ms-sentinel-mcp-server

Instructions

Implementation Reference

• tools/analytics_tools.py:546-606 (handler)

  The handler implementation in the SentinelAnalyticsRuleTemplatesCountByTechniqueTool class, including the name definition and the run method that lists analytics rule templates, extracts techniques using the helper function, counts them by technique, and returns the results.
  class SentinelAnalyticsRuleTemplatesCountByTechniqueTool(MCPToolBase): """ Count Sentinel analytics rule templates by MITRE technique. Extracts techniques from each template and returns a mapping of technique to count and template summaries. """ name = "sentinel_analytics_rule_templates_count_by_technique" description = "Count Sentinel analytics rule templates by MITRE technique." async def run(self, ctx: Context, **kwargs): """ Count analytics rule templates by technique. Returns a dict: {technique: {count: int, templates: [{id, display_name}]}} """ logger = self.logger workspace, resource_group, subscription_id = self.get_azure_context(ctx) client = self.get_securityinsight_client(subscription_id) technique_map = {} try: templates = client.alert_rule_templates.list(resource_group, workspace) for template in templates: template_dict = ( template.as_dict() if hasattr(template, "as_dict") else dict(template) ) _, _, techniques = extract_tags_tactics_techniques_from_dict( template_dict ) display_name = ( template_dict.get("display_name") or template_dict.get("displayName") or template_dict.get("name") ) for technique in techniques or ["Unknown"]: tkey = technique.lower() or "unknown" if tkey not in technique_map: technique_map[tkey] = {"count": 0, "templates": []} technique_map[tkey]["count"] += 1 technique_map[tkey]["templates"].append( { "id": template_dict.get("id"), "display_name": display_name, } ) return { "valid": True, "error": None, "results": technique_map, "errors": [], } except Exception as e: logger.error("Error in %s: %s", self.__class__.__name__, str(e)) return { "valid": False, "error": str(e), "results": None, "errors": [str(e)], }
• tools/analytics_tools.py:622-622 (registration)

  Registration of the SentinelAnalyticsRuleTemplatesCountByTechniqueTool with the MCP server instance.
  SentinelAnalyticsRuleTemplatesCountByTechniqueTool.register(mcp)
• tools/analytics_tools.py:297-357 (helper)

  Helper utility function extract_tags_tactics_techniques_from_dict used by the tool handler to parse tactics and techniques from rule template dictionaries for counting.
  def extract_tags_tactics_techniques_from_dict(obj): """ Extract tags, tactics, and techniques from an analytics rule/template dict. Args: obj (dict): Analytics rule or template dictionary. Returns: tuple: (tags, tactics, techniques) tags (list[dict]): All tags as {name, value} pairs. tactics (list[str]): List of tactics (from tags or legacy fields). techniques (list[str]): List of techniques (from tags or legacy fields). Extraction precedence: - Tactics/techniques: Prefer tags with name 'tactics'/'techniques' (case-insensitive, split on comma). Fallback to legacy fields. - Tags: All tags as {name, value} pairs (robust to SDK object, dict, or string). """ tags = [] tactics = [] techniques = [] raw_tags = obj.get("tags") if raw_tags: for tag in raw_tags: tag_name = None tag_value = None if isinstance(tag, dict): tag_name = tag.get("name") or tag.get("Name") tag_value = tag.get("value") or tag.get("Value") elif hasattr(tag, "name") and hasattr(tag, "value"): tag_name = getattr(tag, "name", None) tag_value = getattr(tag, "value", None) elif isinstance(tag, str): tag_name = tag tag_value = None else: try: tag_name = str(tag) except Exception: continue if tag_name is not None: tags.append({"name": tag_name, "value": tag_value}) for tag in tags: if tag["name"] and isinstance(tag["name"], str): if tag["name"].lower() == "tactics" and tag["value"]: tactics += [t.strip() for t in tag["value"].split(",") if t.strip()] elif tag["name"].lower() == "techniques" and tag["value"]: techniques += [t.strip() for t in tag["value"].split(",") if t.strip()] legacy_tactics = obj.get("tactics") if legacy_tactics: tactics += [ t.strip() for t in legacy_tactics if isinstance(t, str) and t.strip() ] legacy_techniques = obj.get("techniques") if legacy_techniques: techniques += [ t.strip() for t in legacy_techniques if isinstance(t, str) and t.strip() ] tactics = list(dict.fromkeys([t for t in tactics if t])) techniques = list(dict.fromkeys([t for t in techniques if t])) return tags, tactics, techniques