sentinel_analytics_rule_templates_list
Retrieve all Microsoft Sentinel analytics rule templates to implement security monitoring and threat detection workflows.
Instructions
List all Sentinel analytics rule templates
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kwargs | Yes |
Implementation Reference
- tools/analytics_tools.py:178-235 (handler)The MCPToolBase subclass implementing the 'sentinel_analytics_rule_templates_list' tool. It defines the tool name, description, and the async run method that lists Sentinel analytics rule templates using the Azure Security Insights client, extracting summaries like id, name, displayName, description, and kind.
class SentinelAnalyticsRuleTemplatesListTool(MCPToolBase): """ List all Sentinel analytics rule templates in the current workspace. Returns a list of template summaries or error details. """ name = "sentinel_analytics_rule_templates_list" description = "List all Sentinel analytics rule templates" async def run(self, ctx: Context, **kwargs): """ List all analytics rule templates in the current Sentinel workspace. Returns a list of dicts, each containing template summary fields, or error details. Parameters: ctx (Context): MCP context object. **kwargs: No parameters required. Returns: list[dict]: List of template summaries or error dicts. """ logger = self.logger workspace, resource_group, subscription_id = self.get_azure_context(ctx) if not (workspace and resource_group and subscription_id): logger.error( "Missing Azure Sentinel context for analytics rule templates list." ) return [{"error": "Missing Azure Sentinel context."}] try: client = self.get_securityinsight_client(subscription_id) templates = client.alert_rule_templates.list(resource_group, workspace) except Exception as e: logger.error("Error listing analytics rule templates: %s", e) # pylint: disable=consider-using-f-string return [{"error": f"Error listing analytics rule templates: {str(e)}"}] results = [] for template in templates: try: template_dict = ( template.as_dict() if hasattr(template, "as_dict") else dict(template) ) summary = { "id": template_dict.get("id"), "name": template_dict.get("name"), "displayName": template_dict.get("display_name") or template_dict.get("displayName"), "description": template_dict.get("description"), "kind": template_dict.get("kind"), } results.append(summary) except Exception as e: logger.warning("Error processing template: %s", e) results.append({"error": f"Error processing template: {str(e)}"}) return results - tools/analytics_tools.py:617-617 (registration)Registration of the SentinelAnalyticsRuleTemplatesListTool class with the MCP server instance inside the register_tools function.
SentinelAnalyticsRuleTemplatesListTool.register(mcp)