Skip to directory

microsoft-sentinel

Microsoft

HTTP; Microsoft client guide describes adding an HTTP server and does not specify a more precise transport subtype.12+ documented tools0

About microsoft-sentinel

A Microsoft-hosted MCP tool collection for querying Sentinel data-lake workspaces, discovering tables, analyzing users and URLs, and exploring Sentinel security graphs. Microsoft offers other separate collections; this record covers the documented data-exploration collection.

What you can use it for

  • Discover relevant Sentinel data-lake tables for a security question
  • Query security events with KQL
  • Analyze a user or URL using available tenant data and threat intelligence
  • Explore attack paths and exposure in Sentinel security graphs
Connection and setup
Hosting
remote
Transport
HTTP; Microsoft client guide describes adding an HTTP server and does not specify a more precise transport subtype.
Endpoint
https://sentinel.microsoft.com/mcp/data-exploration
Authentication
Microsoft Entra interactive authentication. The general setup guide requires at least Security Reader for listing/invoking tools. Entity analysis additionally requires Security Copilot Contributor and consumes Security Compute Units; graph access requires read-only Microsoft Security Exposure Management access.

Requirements

  • Microsoft Sentinel data lake onboarding for most tools
  • Microsoft Sentinel in Defender portal, Defender XDR/Endpoint, or Security Copilot may be required for specific collections/tools
  • Microsoft Entra account with Security Reader, Security Operator, or Security Administrator role for documented data-exploration collection
  • Security Copilot Contributor role and available SCUs for entity-analysis tools
  • Graph data requires read-only Microsoft Security Exposure Management access

Setup steps

  1. When prompted, allow sign-in with a Microsoft Entra account holding at least Security Reader access.
  2. Open VS Code Chat in Agent mode and confirm the server appears in Configure Tools.
  3. Begin with list_sentinel_workspaces, then use search_tables and query_lake for a read-only lookup. Review query scope before allowing agents to run queries against security data.
Tools 12+

Exact tools below are documented for the data-exploration collection. Microsoft lists separate agent-creation and triage collections, whose full tool catalogs are not represented here; graph tools and entity-analysis tools have extra prerequisites and are preview/usage-metered in part.

  • search_tables

    Search connected workspace table catalogs by natural-language query and return relevant schemas.

    01
  • query_lake

    Execute one KQL query against a Microsoft Sentinel data-lake workspace; intended for focused retrieval, not bulk export.

    02
  • list_sentinel_workspaces

    List accessible Sentinel data-lake workspace names and IDs; run before other tools that require a workspace ID.

    03
  • analyze_user_entity

    Start AI-supported analysis of a Microsoft Entra user entity over a time window.

    04
  • analyze_url_entity

    Start AI-supported analysis of a URL using organization and Microsoft threat-intelligence data.

    05
  • get_entity_analysis

    Retrieve/poll a previously started entity-analysis job.

    06
  • find_blastradius

    Analyze graph propagation paths from an entity toward critical assets.

    07
  • find_walkable_paths

    Find traversable connections between graph source and target entities.

    08
  • find_exposure_perimeter

    List incoming graph connections and exposure paths for a target entity.

    09
  • find_connected_nodes

    Find graph paths between entities matching source and target criteria.

    10
  • find_nodes

    Find graph nodes matching label/property criteria.

    11
  • get_graph_context

    Return graph context, supported functionality, labels, and parameter guidance.

    12

This server’s available tools can vary by account, permissions, or configuration. The list shown is not its full runtime catalog.

Limitations and notes
  • This is a multi-collection server; this record is scoped to the published data-exploration endpoint and does not enumerate all triage or agent-creation tools.
  • Some features are preview and may change.
  • The KQL tool is intended for focused investigation, not bulk export.
  • Entity analyzer latency may be several minutes; get_entity_analysis may need to be called repeatedly. User entity analysis supports at most a seven-day window and requires particular tables; on-premises-only users are unsupported.
  • Entity analyzer usage is subject to published tenant limits and consumes Security Compute Units.
  • Graph queries require graph-specific access and may incur graph metering.
Original sources
  • publisher documentation

    Microsoft Learn documents the hosted data-exploration endpoint; exact search_tables, query_lake, list_sentinel_workspaces, analyze_user_entity, analyze_url_entity, get_entity_analysis, and graph tool names; role and data prerequisites; required list_sentinel_workspaces-first call order; and entity-analysis constraints.

  • publisher client setup

    Microsoft Learn provides VS Code MCP: Add Server steps, says choose HTTP, enter the selected Microsoft Sentinel collection endpoint, authorize with a Security Reader account, then verify in Agent mode Configure Tools.

  • publisher overview

    Microsoft Learn describes the hosted unified server, its separate tool collections and supported use cases, Sentinel data lake onboarding, product prerequisites, and Security Reader requirement.

  • publisher limits and pricing

    Microsoft Learn documents service/tool-specific pricing, request/query constraints, entity-analysis limits, and language/region availability.

Documentation checked 2026-10-28T13:31:11.000Z. Connection has not been runtime tested.

Similar tools