Microsoft Sentinel MCP Server

Example Use Cases

• 1

  Run and validate KQL queries against Microsoft Sentinel data.

• 2

  View and analyze security incidents and analytics rules in Sentinel.

• 3

  Explore Azure Sentinel resources such as watchlists, data connectors, and threat intelligence.

Description

This MCP server enables secure, read-only access to Microsoft Sentinel instances, allowing users to run KQL queries, view incidents, analyze analytics rules, and explore various Sentinel resources. It is designed for test environments to support observation-only security operations and analysis, providing a modular and extensible platform. The server supports multiple authentication methods and integrates with Azure services to facilitate security monitoring and investigation workflows.