sentinel_hunting_queries_count_by_tactic
Count Microsoft Sentinel hunting queries by MITRE ATT&CK tactic to analyze security coverage and identify gaps in threat detection.
Instructions
Count Sentinel hunting queries (saved searches) by tactic
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kwargs | Yes |
Implementation Reference
- tools/hunting_tools.py:142-185 (handler)The main handler class for the tool. It defines the tool name, description, and the async run method that lists Sentinel saved searches, extracts tactics using the helper function, and returns a dictionary mapping tactics to counts and associated query IDs.
class SentinelHuntingQueriesCountByTacticTool(MCPToolBase): name = "sentinel_hunting_queries_count_by_tactic" description = "Count Sentinel hunting queries (saved searches) by tactic" async def run(self, ctx: Context, **_): """ Count Sentinel hunting queries (saved searches) by tactic. Extracts tags, tactics, and techniques using shared utility. """ workspace_name, resource_group, subscription_id = self.get_azure_context(ctx) client = self.get_loganalytics_client(subscription_id) tactic_map = {} try: searches = client.saved_searches.list_by_workspace( resource_group, workspace_name ) for s in getattr(searches, "value", []): _, s_tactics, _ = extract_tags_tactics_techniques(s) for tactic in s_tactics or ["Unknown"]: tkey = tactic.lower() or "unknown" if tkey not in tactic_map: tactic_map[tkey] = {"count": 0, "queries": []} tactic_map[tkey]["count"] += 1 tactic_map[tkey]["queries"].append( { "id": s.id, "display_name": getattr(s, "display_name", s.name), } ) return { "valid": True, "error": None, "results": tactic_map, "errors": [], } except Exception as e: self.logger.error("Error in %s: %s", self.__class__.__name__, str(e)) return { "valid": False, "error": str(e), "results": None, "errors": [str(e)], } - tools/hunting_tools.py:283-287 (registration)Function that registers the hunting tools with the MCP server, including the register call for SentinelHuntingQueriesCountByTacticTool.
def register_tools(mcp: FastMCP): SentinelHuntingQueriesListTool.register(mcp) SentinelHuntingQueriesCountByTacticTool.register(mcp) SentinelHuntingQueryGetTool.register(mcp) - tools/hunting_tools.py:12-74 (helper)Utility function used by the tool to extract tactics (and tags/techniques) from Sentinel saved search objects for categorization.
def extract_tags_tactics_techniques(obj): """ Extracts tags, tactics, and techniques from a hunting query object. Returns: tags: List of {name, value} dicts. tactics: List of tactics (from tags or legacy fields). techniques: List of techniques (from tags or legacy fields). Extraction precedence: - Tactics/techniques: Prefer tags with name 'tactics'/'techniques' (case-insensitive, split on comma). Fallback to legacy fields. - Tags: All tags as {name, value} pairs (robust to SDK object, dict, or string). """ tags = [] tactics = [] techniques = [] # Extract tags as list of {name, value} raw_tags = getattr(obj, "tags", None) if raw_tags: for tag in raw_tags: tag_name = None tag_value = None # Tag as dict if isinstance(tag, dict): tag_name = tag.get("name") or tag.get("Name") tag_value = tag.get("value") or tag.get("Value") # Tag as object with .name/.value elif hasattr(tag, "name") and hasattr(tag, "value"): tag_name = getattr(tag, "name", None) tag_value = getattr(tag, "value", None) # Tag as string: treat as name only elif isinstance(tag, str): tag_name = tag tag_value = None # Fallback: try string conversion else: try: tag_name = str(tag) except Exception: continue if tag_name is not None: tags.append({"name": tag_name, "value": tag_value}) # Tactics/techniques from tags (case-insensitive match) for tag in tags: if tag["name"] and isinstance(tag["name"], str): if tag["name"].lower() == "tactics" and tag["value"]: tactics += [t.strip() for t in tag["value"].split(",") if t.strip()] elif tag["name"].lower() == "techniques" and tag["value"]: techniques += [t.strip() for t in tag["value"].split(",") if t.strip()] # Fallback: legacy fields legacy_tactics = getattr(obj, "tactics", None) if legacy_tactics: tactics += [ t.strip() for t in legacy_tactics if isinstance(t, str) and t.strip() ] legacy_techniques = getattr(obj, "techniques", None) if legacy_techniques: techniques += [ t.strip() for t in legacy_techniques if isinstance(t, str) and t.strip() ] # Deduplicate and preserve order tactics = list(dict.fromkeys([t for t in tactics if t])) techniques = list(dict.fromkeys([t for t in techniques if t])) return tags, tactics, techniques