Microsoft Sentinel MCP Server

Created By
dstreefkerka year ago
MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.
Overview

What is Microsoft Sentinel MCP Server?

Microsoft Sentinel MCP Server is a Model Context Protocol (MCP) server designed for Microsoft Sentinel, providing read-only access to Sentinel logs, incidents, analytics, and Entra ID data through a modular interface. It is strictly for non-production use and is intended for testing environments only.

How to use Microsoft Sentinel MCP Server?

To use the MCP server, authenticate with Azure CLI, clone the repository, and run the provided PowerShell installation script to set it up. After installation, paste the generated configuration into your MCP client to start using the server.

Key features of Microsoft Sentinel MCP Server?

  • KQL Query Execution for testing and validation
  • Log Analytics Management for workspace info and table schemas
  • Security Incidents viewing and management
  • Analytics Rules analysis by MITRE tactics/techniques
  • Access to Rule Templates and Hunting Queries
  • Threat Intelligence lookups for domains and IPs
  • Metadata and Source Control management

Use cases of Microsoft Sentinel MCP Server?

  1. Conducting security operations in a test environment.
  2. Analyzing security incidents and logs without affecting production data.
  3. Testing KQL queries and validating analytics rules.

FAQ from Microsoft Sentinel MCP Server?

  • Is the MCP server safe for production use?

No, it is strictly for test environments and should not be connected to production instances.

  • What kind of data can I access?

You can access logs, incidents, and analytics data from Microsoft Sentinel in a read-only manner.

  • How do I install the MCP server?

Clone the repository and run the PowerShell installation script provided in the repository.

Project Info
Created At
a year ago
Updated At
a year ago
Author Name
dstreefkerk
Star
0
Language
Python
License
MIT license

Recommend Servers

View All
Payai X402 Tools

an hour ago
Payai X402 Tools

an hour ago
AI Work Market — USDC settlement rails for AI labor on Base Mainnet)
@Dario (DME)

AI Work Market is a USDC escrow protocol on Base Mainnet, designed for autonomous AI agents to find work, post jobs, and settle payments without humans in the loop. This MCP server exposes 10 tools: **Escrow lifecycle** - `create_intent_quote` — get calldata + gas estimate for funding a new escrow intent - `submit_proof_quote` — get calldata for the seller to submit a proof URI - `release_funds_quote` — get calldata for the buyer to release payment (or claim/refund) **x402 single-call binding** - `x402_consume` — replaces the 5-step x402 flow with one HMAC-signed POST that returns a delivery URL **Onboarding & discovery** - `agent_onboard` — generate a signed agent card with marketplace attestation - `agent_search` — tf-idf search over the live agent catalog - `agent_reputation` — server-side reputation from on-chain Released/Refunded/Disputed events **Live state** - `system_status` — live on-chain state (nextIntentId, accumulatedFees, contract balance, owner) - `escrow_rules` — contract semantics, lifecycle, call guides, failure modes - `events_subscribe` — SSE stream of new on-chain intent events All endpoints are serverless (Vercel) and return their schema on GET. No browser, no wallet UI required for an agent to integrate. The protocol takes a 1% commission on every settlement; the rest goes to the seller. The full AgentCard is at `/.well-known/agent-card.json` (A2A-compatible). The OpenAPI 3.0.3 spec is at `/.well-known/openapi.json` with `components.securitySchemes` (none, hmacX402). `robots.txt` allows GPTBot, ClaudeBot, anthropic-ai, PerplexityBot, Google-Extended, Applebot-Extended, CCBot, Amazonbot.

a day ago