Skip to main content
Glama
noodlemctwoodle

Sentinel Solutions MCP Server

list_tables

List all unique tables from Microsoft Sentinel solutions. Optionally filter by table type (all, custom, standard) to map data connectors and query security content.

Instructions

Get all unique tables across all solutions

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Implementation Reference

  • The main handler for the list_tables tool. It collects all unique tables from cached analysis results, builds a TableInfo map with connector details, and optionally filters by table type (all/custom/standard).
    export const listTablesTool = {
      name: 'list_tables',
      description: 'Get all unique tables across all solutions',
      inputSchema: z.object({
        table_type: z
          .enum(['all', 'custom', 'standard'])
          .optional()
          .default('all')
          .describe('Filter by table type'),
      }),
      execute: async (args: { table_type?: 'all' | 'custom' | 'standard' }): Promise<TableInfo[]> => {
        await ensureAnalysis();
    
        if (!cachedAnalysisResult) {
          throw new Error('Analysis results not available');
        }
    
        const tableMap = new Map<string, TableInfo>();
    
        cachedAnalysisResult.mappings.forEach((mapping) => {
          if (!tableMap.has(mapping.tableName)) {
            tableMap.set(mapping.tableName, {
              tableName: mapping.tableName,
              isCustomLog: mapping.tableName.endsWith('_CL'),
              connectors: [],
            });
          }
    
          const tableInfo = tableMap.get(mapping.tableName)!;
          tableInfo.connectors.push({
            connectorId: mapping.connectorId,
            connectorTitle: mapping.connectorTitle,
            solution: mapping.solution,
          });
        });
    
        let tables = Array.from(tableMap.values());
    
        // Apply filter
        if (args.table_type === 'custom') {
          tables = tables.filter((t) => t.isCustomLog);
        } else if (args.table_type === 'standard') {
          tables = tables.filter((t) => !t.isCustomLog);
        }
    
        return tables;
      },
  • The TableInfo interface defining the return type structure: tableName, isCustomLog, and connectors array.
    export interface TableInfo {
      tableName: string;
      isCustomLog: boolean;
      connectors: Array<{
        connectorId: string;
        connectorTitle: string;
        solution: string;
      }>;
    }
  • Input schema for the list_tables tool using Zod validation, with an optional enum filter for table_type (all/custom/standard).
    inputSchema: z.object({
      table_type: z
        .enum(['all', 'custom', 'standard'])
        .optional()
        .default('all')
        .describe('Filter by table type'),
    }),
  • Import of listTablesTool from solutionTools module.
    listTablesTool,
    validateConnectorTool,
    solutionTools,
  • Re-export of listTablesTool for external consumption.
    listTablesTool,
    validateConnectorTool,
  • Registration of listTablesTool in the solutionTools array (Tool 5).
    export const solutionTools = [
      analyzeSolutionsTool,
      getConnectorTablesTool,
      searchSolutionsTool,
      getSolutionDetailsTool,
      listTablesTool,
      validateConnectorTool,
    ];
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It does not disclose auth requirements, performance implications, or what happens when no tables exist, beyond a simple read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence with no unnecessary words, front-loading the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the tool is simple and lacks an output schema, the description omits mention of the filtering parameter, which is important context for an agent to use the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the single parameter (table_type) is fully defined in the schema. The description adds no additional meaning, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description provides a specific verb ('Get') and resource ('all unique tables across all solutions'), clearly distinguishing this tool from siblings like list_detections or list_workbooks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives such as get_connector_tables, nor any context about prerequisites or restrictions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/noodlemctwoodle/sentinel-solutions-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server