ms-sentinel-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_DEBUG_LOG | No | Enable debug logging (true/false) | false |
| AZURE_CLIENT_ID | No | The Azure client ID for service principal authentication | |
| AZURE_TENANT_ID | No | The Azure tenant ID | |
| AZURE_WORKSPACE_ID | No | The ID of the Sentinel workspace | |
| AZURE_CLIENT_SECRET | No | The Azure client secret for service principal authentication | |
| AZURE_RESOURCE_GROUP | No | The Azure resource group containing the Sentinel workspace | |
| AZURE_WORKSPACE_NAME | No | The name of the Sentinel workspace | |
| AZURE_SUBSCRIPTION_ID | No | The Azure subscription ID |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| sentinel_logs_searchC | Run a KQL query against Azure Monitor |
| sentinel_logs_search_with_dummy_dataC | Test a KQL query with mock data using a datatable. Validates KQL locally first. |
| sentinel_incident_listC | List security incidents in Microsoft Sentinel |
| sentinel_incident_getC | Get detailed information about a specific Sentinel incident |
| sentinel_workspace_getD | Get workspace information (refactored, MCP-compliant) |
| sentinel_source_controls_listC | List all Sentinel source controls in the current workspace. |
| sentinel_source_control_getC | Get details for a specific Sentinel source control by ID. |
| sentinel_metadata_listC | List all Sentinel metadata in the current workspace. |
| sentinel_metadata_getC | Get details for specific Sentinel metadata by ID. |
| sentinel_ml_analytics_settings_listC | List all Sentinel ML analytics settings in the current workspace. |
| sentinel_ml_analytics_setting_getC | Get a specific Sentinel ML analytics setting by name. |
| sentinel_analytics_rule_listC | List all analytics rules with key fields |
| sentinel_analytics_rule_getC | Get details for a specific analytics rule |
| sentinel_analytics_rule_templates_listC | List all Sentinel analytics rule templates |
| sentinel_analytics_rule_template_getC | Get a specific Sentinel analytics rule template |
| sentinel_analytics_rules_count_by_tacticC | Count Sentinel analytics rules by tactic. |
| sentinel_analytics_rule_templates_count_by_tacticC | Count Sentinel analytics rule templates by tactic. |
| sentinel_analytics_rules_count_by_techniqueC | Count Sentinel analytics rules by MITRE technique. |
| sentinel_analytics_rule_templates_count_by_techniqueC | Count Sentinel analytics rule templates by MITRE technique. |
| markdown_templates_listC | List available markdown templates and their descriptions. |
| markdown_template_getC | Get the raw markdown content for a specific template by name. |
| tool_docs_listC | Enumerate available Sentinel server documentation markdown paths. |
| tool_docs_getC | Return the raw markdown for a given documentation path. |
| tool_docs_searchC | Full-text search across documentation; returns matching paths. |
| llm_instructions_getB | Retrieve the LLM usage instructions for the Sentinel MCP Server. Use this tool first before all other tools. |
| sentinel_authorization_summaryC | Summarize Azure RBAC role assignments for Sentinel and Log Analytics access. |
| sentinel_hunting_queries_listB | List all Sentinel hunting queries (saved searches) with optional tactic/technique filtering |
| sentinel_hunting_queries_count_by_tacticC | Count Sentinel hunting queries (saved searches) by tactic |
| sentinel_hunting_query_getC | Get full details of a Sentinel hunting query (saved search) by name or ID. |
| sentinel_logs_tables_listC | List available tables in the Log Analytics workspace |
| sentinel_logs_table_schema_getC | Get schema (columns/types) for a Log Analytics table |
| sentinel_logs_table_details_getC | Get details (metadata, retention, row count, etc.) for a Log Analytics table |
| sentinel_query_validateC | Validate KQL Query Syntax locally |
| entra_id_list_usersC | List users in Entra ID (Azure AD) via Microsoft Graph API. |
| entra_id_get_userC | Get a user from Entra ID (Azure AD) by object ID, UPN, or email address. |
| entra_id_list_groupsC | List groups in Entra ID (Azure AD) via Microsoft Graph API. |
| entra_id_get_groupC | Get a group from Entra ID (Azure AD) by object ID. |
| log_analytics_saved_searches_listC | List all saved searches in a Log Analytics workspace |
| log_analytics_saved_search_getC | Get a specific saved search from a Log Analytics workspace |
| sentinel_watchlists_listC | List all Sentinel watchlists |
| sentinel_watchlist_getD | Get a specific Sentinel watchlist |
| sentinel_watchlist_items_listC | List all items in a Sentinel watchlist |
| sentinel_watchlist_item_getC | Get a specific item from a Sentinel watchlist |
| sentinel_connectors_listC | List data connectors |
| sentinel_connectors_getC | Get a specific data connector by ID |
| sentinel_ti_indicator_getC | Get a specific Sentinel threat intelligence indicator |
| sentinel_ti_indicator_metrics_collectC | Collect metrics for Sentinel threat intelligence indicators |
| sentinel_ip_geodata_getC | Get geolocation data for an IP address |
| sentinel_domain_whois_getC | Get WHOIS information for a domain |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| sentinel_hunting_investigate_ip | Investigate an IP address |
| sentinel_incident_respond | Incident response workflow |
| sentinel_analytics_create_detection | Create a detection query |
| sentinel_hunting_create_query | Create an advanced KQL query |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| sentinel://reference/kql/basics | |
| resource://instructions | |
| sentinel://reference/kql/examples | |
| sentinel://reference/kql/examples/security |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/dstreefkerk/ms-sentinel-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server