ms-sentinel-mcp-server

Instructions

Implementation Reference

• tools/analytics_tools.py:546-606 (handler)

  The handler implementation in the SentinelAnalyticsRuleTemplatesCountByTechniqueTool class, including the name definition and the run method that lists analytics rule templates, extracts techniques using the helper function, counts them by technique, and returns the results.

  class SentinelAnalyticsRuleTemplatesCountByTechniqueTool(MCPToolBase):
      """
      Count Sentinel analytics rule templates by MITRE technique.
      Extracts techniques from each template and returns a mapping of technique to
      count and template summaries.
      """
  
      name = "sentinel_analytics_rule_templates_count_by_technique"
      description = "Count Sentinel analytics rule templates by MITRE technique."
  
      async def run(self, ctx: Context, **kwargs):
          """
          Count analytics rule templates by technique.
          Returns a dict: {technique: {count: int, templates: [{id, display_name}]}}
          """
          logger = self.logger
          workspace, resource_group, subscription_id = self.get_azure_context(ctx)
          client = self.get_securityinsight_client(subscription_id)
          technique_map = {}
          try:
              templates = client.alert_rule_templates.list(resource_group, workspace)
              for template in templates:
                  template_dict = (
                      template.as_dict()
                      if hasattr(template, "as_dict")
                      else dict(template)
                  )
                  _, _, techniques = extract_tags_tactics_techniques_from_dict(
                      template_dict
                  )
                  display_name = (
                      template_dict.get("display_name")
                      or template_dict.get("displayName")
                      or template_dict.get("name")
                  )
                  for technique in techniques or ["Unknown"]:
                      tkey = technique.lower() or "unknown"
                      if tkey not in technique_map:
                          technique_map[tkey] = {"count": 0, "templates": []}
                      technique_map[tkey]["count"] += 1
                      technique_map[tkey]["templates"].append(
                          {
                              "id": template_dict.get("id"),
                              "display_name": display_name,
                          }
                      )
              return {
                  "valid": True,
                  "error": None,
                  "results": technique_map,
                  "errors": [],
              }
          except Exception as e:
              logger.error("Error in %s: %s", self.__class__.__name__, str(e))
              return {
                  "valid": False,
                  "error": str(e),
                  "results": None,
                  "errors": [str(e)],
              }

• tools/analytics_tools.py:622-622 (registration)

  Registration of the SentinelAnalyticsRuleTemplatesCountByTechniqueTool with the MCP server instance.

  SentinelAnalyticsRuleTemplatesCountByTechniqueTool.register(mcp)

• tools/analytics_tools.py:297-357 (helper)

  Helper utility function extract_tags_tactics_techniques_from_dict used by the tool handler to parse tactics and techniques from rule template dictionaries for counting.

  def extract_tags_tactics_techniques_from_dict(obj):
      """
        Extract tags, tactics, and techniques from an analytics rule/template dict.
  
      Args:
          obj (dict): Analytics rule or template dictionary.
  
      Returns:
          tuple: (tags, tactics, techniques)
              tags (list[dict]): All tags as {name, value} pairs.
              tactics (list[str]): List of tactics (from tags or legacy fields).
              techniques (list[str]): List of techniques (from tags or legacy fields).
  
      Extraction precedence:
          - Tactics/techniques: Prefer tags with name 'tactics'/'techniques'
            (case-insensitive, split on comma). Fallback to legacy fields.
          - Tags: All tags as {name, value} pairs (robust to SDK object, dict, or string).
      """
      tags = []
      tactics = []
      techniques = []
      raw_tags = obj.get("tags")
      if raw_tags:
          for tag in raw_tags:
              tag_name = None
              tag_value = None
              if isinstance(tag, dict):
                  tag_name = tag.get("name") or tag.get("Name")
                  tag_value = tag.get("value") or tag.get("Value")
              elif hasattr(tag, "name") and hasattr(tag, "value"):
                  tag_name = getattr(tag, "name", None)
                  tag_value = getattr(tag, "value", None)
              elif isinstance(tag, str):
                  tag_name = tag
                  tag_value = None
              else:
                  try:
                      tag_name = str(tag)
                  except Exception:
                      continue
              if tag_name is not None:
                  tags.append({"name": tag_name, "value": tag_value})
      for tag in tags:
          if tag["name"] and isinstance(tag["name"], str):
              if tag["name"].lower() == "tactics" and tag["value"]:
                  tactics += [t.strip() for t in tag["value"].split(",") if t.strip()]
              elif tag["name"].lower() == "techniques" and tag["value"]:
                  techniques += [t.strip() for t in tag["value"].split(",") if t.strip()]
      legacy_tactics = obj.get("tactics")
      if legacy_tactics:
          tactics += [
              t.strip() for t in legacy_tactics if isinstance(t, str) and t.strip()
          ]
      legacy_techniques = obj.get("techniques")
      if legacy_techniques:
          techniques += [
              t.strip() for t in legacy_techniques if isinstance(t, str) and t.strip()
          ]
      tactics = list(dict.fromkeys([t for t in tactics if t]))
      techniques = list(dict.fromkeys([t for t in techniques if t]))
      return tags, tactics, techniques