sentinel_metadata_list
Lists all Microsoft Sentinel metadata in your current workspace to help you manage and organize security monitoring resources.
Instructions
List all Sentinel metadata in the current workspace.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kwargs | Yes |
Implementation Reference
- tools/workspace_tools.py:244-308 (handler)SentinelMetadataListTool class: the core handler implementation for the 'sentinel_metadata_list' tool. Inherits from MCPToolBase, defines the tool name, description, and the async run() method that fetches and returns metadata list from the Sentinel workspace using the Azure SecurityInsights client.
class SentinelMetadataListTool(MCPToolBase): """ Tool for listing all Sentinel metadata in the current workspace. """ name = "sentinel_metadata_list" description = "List all Sentinel metadata in the current workspace." async def run(self, ctx: Context, **kwargs): """ List all metadata in the current Sentinel workspace. Parameters: None required. (Context is extracted from MCP or environment.) Returns: dict: { 'metadata': list[dict], 'valid': bool, 'errors': list[str], 'error': str (optional, present only if an error occurs) } Output Fields: - metadata: List of metadata objects (id, name, kind, etc.) - valid: True if successful, False otherwise - errors: List of error messages (empty if none) - error: Error message if an error occurs (optional) Error cases will always include an 'error' key for testability. """ logger = self.logger workspace_name, resource_group, subscription_id = self.get_azure_context(ctx) result = { "metadata": [], "valid": False, "errors": [], } try: client = self.get_securityinsight_client(subscription_id) metadata_objs = client.metadata.list(resource_group, workspace_name) metadata_list = [] for meta in metadata_objs: metadata_list.append( { "id": getattr(meta, "id", None), "name": getattr(meta, "name", None), "kind": getattr(meta, "kind", None), "content_id": getattr(meta, "content_id", None), "version": getattr(meta, "version", None), "parent_id": getattr(meta, "parent_id", None), "author": getattr(meta, "author", None), "source": getattr(meta, "source", None), "support": getattr(meta, "support", None), "categories": getattr(meta, "categories", None), "dependencies": getattr(meta, "dependencies", None), "created": str(getattr(meta, "created", "")), "last_modified": str(getattr(meta, "last_modified", "")), } ) result["metadata"] = metadata_list result["valid"] = True except Exception as ex: error_msg = "Error listing metadata: %s" % ex logger.exception("%s", error_msg) result["error"] = error_msg result["errors"].append(error_msg) return result - tools/workspace_tools.py:570-579 (registration)The register_tools function registers SentinelMetadataListTool (among others) with the MCP server instance via SentinelMetadataListTool.register(mcp).
def register_tools(mcp): """Register all Sentinel workspace-related tools with the MCP server instance.""" SentinelWorkspaceGetTool.register(mcp) SentinelSourceControlsListTool.register(mcp) SentinelSourceControlGetTool.register(mcp) SentinelMetadataListTool.register(mcp) SentinelMetadataGetTool.register(mcp) SentinelMLAnalyticsSettingsListTool.register(mcp) SentinelMLAnalyticsSettingGetTool.register(mcp) - tools/workspace_tools.py:245-251 (schema)Tool schema definition: includes name, description, and detailed docstring specifying input parameters (none) and output schema (metadata list, valid flag, errors, optional error).
""" Tool for listing all Sentinel metadata in the current workspace. """ name = "sentinel_metadata_list" description = "List all Sentinel metadata in the current workspace."