ms-sentinel-mcp-server

Instructions

Implementation Reference

• tools/watchlist_tools.py:18-89 (handler)

  The handler class SentinelWatchlistsListTool that defines and implements the 'sentinel_watchlists_list' tool. It inherits from MCPToolBase and contains the async run method which lists all watchlists using the Azure SecurityInsights client.

  class SentinelWatchlistsListTool(MCPToolBase):
      """
      Tool for listing all Microsoft Sentinel watchlists in the configured workspace.
      """
  
      name = "sentinel_watchlists_list"
      description = "List all Sentinel watchlists"
  
      async def run(self, ctx: Context, **kwargs):
          logger = self.logger
  
          # Get Azure context and SecurityInsights client using MCPToolBase methods
          workspace_name, resource_group, subscription_id = self.get_azure_context(ctx)
          try:
              client = self.get_securityinsight_client(subscription_id)
          except Exception as e:
              logger.error("Error initializing Azure SecurityInsights client: %s", e)
              return {
                  "error": (
                      "Azure SecurityInsights client initialization failed: %s" % str(e)
                  )
              }
          if client is None:
              return {"error": "Azure SecurityInsights client is not initialized"}
  
          try:
              # List all watchlists
              watchlists = await run_in_thread(
                  client.watchlists.list,
                  resource_group_name=resource_group,
                  workspace_name=workspace_name,
              )
  
              result = []
              for watchlist in watchlists:
                  # Log the watchlist object to understand its structure
                  logger.debug("Watchlist object: %s", watchlist)
  
                  # Create a basic info dictionary with guaranteed attributes
                  watchlist_info = {
                      "id": watchlist.id if hasattr(watchlist, "id") else None,
                      "name": watchlist.name if hasattr(watchlist, "name") else None,
                  }
  
                  # Add properties if they exist
                  if hasattr(watchlist, "properties"):
                      props = watchlist.properties
                      if hasattr(props, "watchlist_alias"):
                          watchlist_info["alias"] = props.watchlist_alias
                      if hasattr(props, "display_name"):
                          watchlist_info["displayName"] = props.display_name
                      if hasattr(props, "description"):
                          watchlist_info["description"] = props.description
                      if hasattr(props, "provider"):
                          watchlist_info["provider"] = props.provider
                      if hasattr(props, "source"):
                          watchlist_info["source"] = props.source
                      if hasattr(props, "items_search_key"):
                          watchlist_info["itemsSearchKey"] = props.items_search_key
                      if hasattr(props, "created_time_utc"):
                          watchlist_info["created"] = props.created_time_utc
                      if hasattr(props, "updated_time_utc"):
                          watchlist_info["updated"] = props.updated_time_utc
                      if hasattr(props, "items_count"):
                          watchlist_info["itemsCount"] = props.items_count
                  result.append(watchlist_info)
  
              return {"watchlists": result, "count": len(result), "valid": True}
          except Exception as e:
              logger.error("Error retrieving watchlists: %s", e)
              return {"error": f"Error retrieving watchlists: {str(e)}"}

• tools/watchlist_tools.py:382-393 (registration)

  The register_tools function where SentinelWatchlistsListTool.register(mcp) is called to register the tool with the MCP server.

  def register_tools(mcp: FastMCP):
      """
      Register all Sentinel watchlist tools with the MCP server instance.
  
      Args:
          mcp (FastMCP): The MCP server instance to register tools with.
      """
      SentinelWatchlistsListTool.register(mcp)
      SentinelWatchlistGetTool.register(mcp)
      SentinelWatchlistItemsListTool.register(mcp)
      SentinelWatchlistItemGetTool.register(mcp)