list_tables
List all unique tables from Microsoft Sentinel solutions. Optionally filter by table type (all, custom, standard) to map data connectors and query security content.
Instructions
Get all unique tables across all solutions
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- src/tools/solutionTools.ts:298-344 (handler)The main handler for the list_tables tool. It collects all unique tables from cached analysis results, builds a TableInfo map with connector details, and optionally filters by table type (all/custom/standard).
export const listTablesTool = { name: 'list_tables', description: 'Get all unique tables across all solutions', inputSchema: z.object({ table_type: z .enum(['all', 'custom', 'standard']) .optional() .default('all') .describe('Filter by table type'), }), execute: async (args: { table_type?: 'all' | 'custom' | 'standard' }): Promise<TableInfo[]> => { await ensureAnalysis(); if (!cachedAnalysisResult) { throw new Error('Analysis results not available'); } const tableMap = new Map<string, TableInfo>(); cachedAnalysisResult.mappings.forEach((mapping) => { if (!tableMap.has(mapping.tableName)) { tableMap.set(mapping.tableName, { tableName: mapping.tableName, isCustomLog: mapping.tableName.endsWith('_CL'), connectors: [], }); } const tableInfo = tableMap.get(mapping.tableName)!; tableInfo.connectors.push({ connectorId: mapping.connectorId, connectorTitle: mapping.connectorTitle, solution: mapping.solution, }); }); let tables = Array.from(tableMap.values()); // Apply filter if (args.table_type === 'custom') { tables = tables.filter((t) => t.isCustomLog); } else if (args.table_type === 'standard') { tables = tables.filter((t) => !t.isCustomLog); } return tables; }, - src/types/index.ts:137-145 (schema)The TableInfo interface defining the return type structure: tableName, isCustomLog, and connectors array.
export interface TableInfo { tableName: string; isCustomLog: boolean; connectors: Array<{ connectorId: string; connectorTitle: string; solution: string; }>; } - src/tools/solutionTools.ts:301-307 (schema)Input schema for the list_tables tool using Zod validation, with an optional enum filter for table_type (all/custom/standard).
inputSchema: z.object({ table_type: z .enum(['all', 'custom', 'standard']) .optional() .default('all') .describe('Filter by table type'), }), - src/tools/index.ts:17-19 (registration)Import of listTablesTool from solutionTools module.
listTablesTool, validateConnectorTool, solutionTools, - src/tools/index.ts:61-62 (registration)Re-export of listTablesTool for external consumption.
listTablesTool, validateConnectorTool, - src/tools/solutionTools.ts:410-417 (registration)Registration of listTablesTool in the solutionTools array (Tool 5).
export const solutionTools = [ analyzeSolutionsTool, getConnectorTablesTool, searchSolutionsTool, getSolutionDetailsTool, listTablesTool, validateConnectorTool, ];