ms-sentinel-mcp-server

Instructions

Implementation Reference

• tools/analytics_tools.py:178-235 (handler)

  The SentinelAnalyticsRuleTemplatesListTool class is the main handler implementation. It defines the tool name, description, and the async run method that lists all analytics rule templates from the Sentinel workspace using the Azure SDK, processes them into summaries (id, name, displayName, description, kind), and handles errors.
  class SentinelAnalyticsRuleTemplatesListTool(MCPToolBase): """ List all Sentinel analytics rule templates in the current workspace. Returns a list of template summaries or error details. """ name = "sentinel_analytics_rule_templates_list" description = "List all Sentinel analytics rule templates" async def run(self, ctx: Context, **kwargs): """ List all analytics rule templates in the current Sentinel workspace. Returns a list of dicts, each containing template summary fields, or error details. Parameters: ctx (Context): MCP context object. **kwargs: No parameters required. Returns: list[dict]: List of template summaries or error dicts. """ logger = self.logger workspace, resource_group, subscription_id = self.get_azure_context(ctx) if not (workspace and resource_group and subscription_id): logger.error( "Missing Azure Sentinel context for analytics rule templates list." ) return [{"error": "Missing Azure Sentinel context."}] try: client = self.get_securityinsight_client(subscription_id) templates = client.alert_rule_templates.list(resource_group, workspace) except Exception as e: logger.error("Error listing analytics rule templates: %s", e) # pylint: disable=consider-using-f-string return [{"error": f"Error listing analytics rule templates: {str(e)}"}] results = [] for template in templates: try: template_dict = ( template.as_dict() if hasattr(template, "as_dict") else dict(template) ) summary = { "id": template_dict.get("id"), "name": template_dict.get("name"), "displayName": template_dict.get("display_name") or template_dict.get("displayName"), "description": template_dict.get("description"), "kind": template_dict.get("kind"), } results.append(summary) except Exception as e: logger.warning("Error processing template: %s", e) results.append({"error": f"Error processing template: {str(e)}"}) return results
• tools/analytics_tools.py:617-617 (registration)

  Registration of the SentinelAnalyticsRuleTemplatesListTool with the MCP server instance in the register_tools function.
  SentinelAnalyticsRuleTemplatesListTool.register(mcp)
• tools/analytics_tools.py:184-186 (schema)

  Tool name and description, which serve as the input/output schema indicators for the MCP tool.
  name = "sentinel_analytics_rule_templates_list" description = "List all Sentinel analytics rule templates"