Microsoft Security Copilot

🚀 Security Copilot and Sentinel MCP Server

A Python-based MCP server that integrates with Microsoft Security Copilot and Microsoft Sentinel using the FastMCP library and authenticates via Azure Identity.

🚀 Quick Start

This project implements an MCP server with the following capabilities:

• Execute KQL queries in Microsoft Sentinel.
• Upload/Update skill sets/plugins for Microsoft Security Copilot.
• Run prompts or skills in Microsoft Security Copilot.

This server acts as a bridge between the development environment and Microsoft Security Copilot, supporting the testing, deployment, and execution of skills and plugins. It is an MCP server that uses SSE as the transport layer.

The current integration has multiple use - cases, with the most interesting one being the support for the development, testing, and deployment of Security Copilot KQL skills.

✨ Features

• Sentinel Integration: Execute KQL queries in Microsoft Sentinel.
• Security Copilot Management:
  • List existing skill sets/plugins.
  • Upload new skills or update existing ones.
  • Run prompts or skills in Microsoft Security Copilot.
• Authentication Support: Supports multiple authentication methods, including interactive browser, client secret, and managed identity.

📈 Roadmap

The upcoming features will include:

• Promptbook Testing and Update
• Run Advanced Hunting Queries in Defender XDR

📋 Prerequisites

• Python 3.8+
• A Microsoft Sentinel workspace
• Access to Microsoft Security Copilot
• Appropriate Azure permissions for Microsoft Sentinel and Security Copilot

📦 Installation

1. Clone the repository:

   git clone https://github.com/jguimera/SecurityCopilotMCPServer.git
   cd SecurityCopilotMCPServer
   

2. Install the dependencies:

   pip install -r requirements.txt
   

3. Create a .env file and configure the following:

   # Add application registration to authenticate with client ID and secret
   # AZURE_TENANT_ID=Your Tenant ID
   # AZURE_CLIENT_ID=Your Client ID
   # AZURE_CLIENT_SECRET=Your Client Secret
   SENTINEL_SUBSCRIPTION_ID=Your Subscription ID
   SENTINEL_RESOURCE_GROUP=Your Resource Group
   SENTINEL_WORKSPACE_NAME=Your Workspace Name
   SENTINEL_WORKSPACE_ID=Your Workspace ID
   # Authentication options: interactive, client_secret
   AUTHENTICATION_TYPE=interactive
   

💻 Usage Examples

Basic Usage

Start the Server

Run the MCP server:

python server.py

Run tests before starting the server:

python server.py --run-tests

Available Tools

The tools provided by the MCP server include:

1. run_sentinel_query: Execute a KQL query in Sentinel.
2. get_skillsets: List the skill sets in Security Copilot.
3. upload_plugin: Upload or update a skill set/plugin.
4. run_prompt: Run a prompt or skill in Security Copilot.

MCP Client Configuration (for Cursor)

You can use this MCP server from any client of your choice. In this repository, you'll find instructions and configuration files for Cursor.

Add a .cursor folder to your client project to enable MCP tools. This folder contains two files:

1. Cursor Project Rules (securitycopilotdev.mdc): This file contains some custom Cursor rules to help the proxy understand user prompts.
2. MCP Client Configuration (mcp.json): The file to connect Cursor to the MCP server.

You can run tools via the /tool_name command. For example:

/clean_code

Specify the required parameters and credentials in the configuration file for the tools to work properly.

Contribution Guidelines

If you wish to contribute to the project, follow these steps:

1. Create a feature branch from the main branch.
2. Commit your changes and create a pull request.
3. Discuss your changes and make adjustments based on feedback.
4. Push to the main branch.

📄 License

This project is licensed under the MIT License, as follows:

 MIT License

Copyright (c) [Year] [Author Name]

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.