Securitycopilotmcpserver

🚀 Security Copilot and Sentinel MCP Server

A Python-based MCP server integrated with Microsoft Security Copilot and Microsoft Sentinel using the FastMCP library, supporting authentication via Azure Identity.

🚀 Quick Start

This project implements an MCP server with the following functions:

• Execute KQL queries on Microsoft Sentinel.
• Upload/update skill sets/plugins in Microsoft Security Copilot.
• Execute prompts and skills in Microsoft Security Copilot.

This server acts as a bridge between the development environment and Microsoft Security Copilot, supporting the testing, deployment, and execution of skills and plugins. It is an MCP server using SSE as the transport layer.

There are many use cases for the current integration, and one of the most interesting is supporting the development, testing, and deployment of Security Copilot KQL skills.

✨ Features

• Sentinel Integration: Execute KQL queries in the Sentinel workspace.
• Security Copilot Management:
  • List existing skill sets/plugins.
  • Upload new or update existing skill sets/plugins.
  • Execute prompts or skills in Security Copilot.
• Authentication Support: Multiple authentication methods, including interactive browser, client secret, and managed identity.

🗺️ Roadmap

The upcoming features will include:

• Promptbook testing and updating
• Running advanced hunting queries in Defender XDR

📋 Prerequisites

• Python 3.8+
• A Microsoft Sentinel workspace
• Access to Microsoft Security Copilot
• Appropriate Azure permissions for Sentinel and Security Copilot

📦 Installation

1. Clone the repository:

   git clone https://github.com/jguimera/SecurityCopilotMCPServer.git
   cd SecurityCopilotMCPServer
   

2. Install the dependencies:

   pip install -r requirements.txt
   

3. Create a .env file and configure it as follows:

   # Add an app registration to authenticate with a client ID and secret
   # AZURE_TENANT_ID=your_tenant_id
   # AZURE_CLIENT_ID=your_client_id
   # AZURE_CLIENT_SECRET=your_client_secret
   SENTINEL_SUBSCRIPTION_ID=your_subscription_id
   SENTINEL_RESOURCE_GROUP=your_resource_group
   SENTINEL_WORKSPACE_NAME=your_workspace_name
   SENTINEL_WORKSPACE_ID=your_workspace_id
   # Authentication options: interactive, client_secret
   AUTHENTICATION_TYPE=interactive
   

💻 Usage Examples

Start the Server

Run the MCP server:

python server.py

Run tests before starting the server:

python server.py --run-tests

Available Tools

The tools provided by the MCP server include:

1. run_sentinel_query: Execute a KQL query in Sentinel.
2. get_skillsets: List the skill sets in Security Copilot.
3. upload_plugin: Upload or update a skill set/plugin.
4. run_prompt: Run a prompt or skill in Security Copilot.

Configure the MCP Client for Cursor

You can use this MCP server from your chosen client. In this repository, you'll find instructions and configuration files for Cursor.

Add a .cursor folder to your client project to enable the MCP tools. This folder contains two files:

1. Cursor Project Rules (securitycopilotdev.mdc): This file includes some custom Cursor rules to help the proxy understand the process of user prompts.
2. MCP Client Configuration (mcp.json): The file for connecting to the MCP server.

You can directly call a tool using the /tool_name parameter1="Value of the tool parameter". For example: /run_prompt content="List users with high risks recently"

For more detailed information, refer to: https://docs.cursor.com/context/model-context-protocol#configuring-an-mcp-server

🤝 Contribution

Contributions are welcome! Please feel free to submit a Pull Request.

📄 License

This project is licensed under the LICENSE.