Supports environment variable configuration for authentication and server settings through .env files, allowing secure storage of Azure credentials and server configuration.
Enables access to source control information for Sentinel resources, including listing and viewing repository details for security content managed through source control.
Referenced as the repository hosting location for the MCP server, allowing users to clone and install the server from GitHub.
Utilizes Python as the implementation language, with support for Python-based environment setup, dependency management, and execution of the MCP server.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ms-sentinel-mcp-server list recent security incidents from the last 24 hours"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
🗄️ This repository is archived and no longer maintained
Microsoft has released an official, hosted Sentinel MCP server — use that instead: Get started with the Sentinel MCP server
This was an experimental, read-only Model Context Protocol (MCP) server for Microsoft Sentinel, intended for test environments only. The implementation has been retired and removed; this README is all that remains.
Related MCP server: mcp-kql-server
This project is licensed under the MIT License.
Get a group from Entra ID (Azure AD) by object ID.
Inputs: kwargs (required).
Get a user from Entra ID (Azure AD) by object ID, UPN, or email address.
Inputs: kwargs (required).
List groups in Entra ID (Azure AD) via Microsoft Graph API.
Inputs: kwargs (required).
List users in Entra ID (Azure AD) via Microsoft Graph API.
Inputs: kwargs (required).
Retrieve the LLM usage instructions for the Sentinel MCP Server. Use this tool first before all other tools.
Inputs: kwargs (required).
List all saved searches in a Log Analytics workspace
Inputs: kwargs (required).
Get a specific saved search from a Log Analytics workspace
Inputs: kwargs (required).
Get the raw markdown content for a specific template by name.
Inputs: kwargs (required).
List available markdown templates and their descriptions.
Inputs: kwargs (required).
Get details for a specific analytics rule
Inputs: kwargs (required).
List all analytics rules with key fields
Inputs: kwargs (required).
Count Sentinel analytics rules by tactic.
Inputs: kwargs (required).
Count Sentinel analytics rules by MITRE technique.
Inputs: kwargs (required).
Get a specific Sentinel analytics rule template
Inputs: kwargs (required).
Count Sentinel analytics rule templates by tactic.
Inputs: kwargs (required).
Count Sentinel analytics rule templates by MITRE technique.
Inputs: kwargs (required).
List all Sentinel analytics rule templates
Inputs: kwargs (required).
Summarize Azure RBAC role assignments for Sentinel and Log Analytics access.
Inputs: kwargs (required).
Get a specific data connector by ID
Inputs: kwargs (required).
List data connectors
Inputs: kwargs (required).
Get WHOIS information for a domain
Inputs: kwargs (required).
Count Sentinel hunting queries (saved searches) by tactic
Inputs: kwargs (required).
List all Sentinel hunting queries (saved searches) with optional tactic/technique filtering
Inputs: kwargs (required).
Get full details of a Sentinel hunting query (saved search) by name or ID.
Inputs: kwargs (required).
Get detailed information about a specific Sentinel incident
Inputs: kwargs (required).
List security incidents in Microsoft Sentinel
Inputs: kwargs (required).
Get geolocation data for an IP address
Inputs: kwargs (required).
Run a KQL query against Azure Monitor
Inputs: kwargs (required).
Test a KQL query with mock data using a datatable. Validates KQL locally first.
Inputs: kwargs (required).
Get details (metadata, retention, row count, etc.) for a Log Analytics table
Inputs: kwargs (required).
Get schema (columns/types) for a Log Analytics table
Inputs: kwargs (required).
List available tables in the Log Analytics workspace
Inputs: kwargs (required).
Get details for specific Sentinel metadata by ID.
Inputs: kwargs (required).
List all Sentinel metadata in the current workspace.
Inputs: kwargs (required).
Get a specific Sentinel ML analytics setting by name.
Inputs: kwargs (required).
List all Sentinel ML analytics settings in the current workspace.
Inputs: kwargs (required).
Validate KQL Query Syntax locally
Inputs: kwargs (required).
Get details for a specific Sentinel source control by ID.
Inputs: kwargs (required).
List all Sentinel source controls in the current workspace.
Inputs: kwargs (required).
Get a specific Sentinel threat intelligence indicator
Inputs: kwargs (required).
Collect metrics for Sentinel threat intelligence indicators
Inputs: kwargs (required).
Get a specific Sentinel watchlist
Inputs: kwargs (required).
Get a specific item from a Sentinel watchlist
Inputs: kwargs (required).
List all items in a Sentinel watchlist
Inputs: kwargs (required).
List all Sentinel watchlists
Inputs: kwargs (required).
Get workspace information (refactored, MCP-compliant)
Inputs: kwargs (required).
Return the raw markdown for a given documentation path.
Inputs: kwargs (required).
Enumerate available Sentinel server documentation markdown paths.
Inputs: kwargs (required).
Full-text search across documentation; returns matching paths.
Inputs: kwargs (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 49 tools
Most tools have distinct purposes targeting specific Sentinel resources (e.g., incidents, rules, connectors) with clear action verbs, though some overlap exists between sentinel_logs_search and sentinel_logs_search_with_dummy_data, and between markdown_template_get and tool_docs_get. The descriptions help clarify differences, but agents might occasionally confuse similar tools.
Tool names follow a highly consistent snake_case pattern with a clear verb_noun structure throughout (e.g., sentinel_incident_get, sentinel_analytics_rule_list). All tools adhere to this convention, making them predictable and easy to parse, with no mixing of styles or chaotic naming.
With 49 tools, the count is excessive for a single server, likely overwhelming for agents and indicating poor scoping. While Sentinel is a broad domain, this many tools suggests fragmentation or redundancy, such as multiple counting tools (e.g., sentinel_analytics_rules_count_by_tactic, sentinel_analytics_rules_count_by_technique) that could be consolidated.
The tool set provides comprehensive coverage of the Sentinel domain, including CRUD operations for incidents, rules, connectors, watchlists, and metadata, plus utilities for logs, queries, and documentation. No obvious gaps exist; agents can perform full lifecycle management and analysis tasks without dead ends.
Official Microsoft MCP Server to query Microsoft Entra data using natural language
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server for Sentry - error monitoring, issue tracking, and debugging for AI assistants
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
