Microsoft Sentinel

This is an MCP server designed for Microsoft Sentinel, providing read-only access to Sentinel instances, including advanced queries, event viewing, and resource exploration capabilities. It supports various operations such as KQL query execution, log analysis management, and security event viewing, but is only suitable for the test environment and should not be used in the production environment.

Security Cloud platform .Python

rating : 2.5 points

downloads : 5.7K

update time : 2025-05-07

Open Site

What is the Microsoft Sentinel MCP Server?

The Microsoft Sentinel MCP Server is a secure read-only tool that allows users to explore the capabilities of Microsoft Sentinel in a test environment, including log queries, security event analysis, and resource management.

How to use the Microsoft Sentinel MCP Server?

Through simple installation steps and configuration, you can easily start using the MCP Server for queries and analysis. No professional knowledge is required to get started quickly.

Applicable scenarios

Suitable for security analysts, developers, and technical teams to perform data analysis, threat detection, and incident response in a test environment.

Main features

KQL query execution

Run and validate KQL queries, supporting advanced data analysis in the test environment.

Security event viewing

List and view detailed information about Sentinel security events.

Log table management

List and obtain detailed information and schemas of log tables.

Threat intelligence analysis

Perform WHOIS queries and IP geolocation queries.

Advantages

Supports read-only access to ensure the security of the production environment.

A rich feature set covering log queries, event analysis, and threat intelligence.

Easy to install and configure, suitable for both beginners and experts.

Limitations

Limited to use in the test environment and does not support connection to the production environment.

Requires Azure CLI or service principal authentication to run.

How to use

Install the dependent environment

Run the PowerShell script to complete the environment initialization and dependency installation.

Configure Azure credentials

Start the MCP Server

Run the script to start the MCP Server and generate the configuration file.

Usage examples

Query security events

Find recent security events through a KQL query.

View details of a specific event

Get detailed information about a security event with a specified ID.

Frequently Asked Questions

Does the MCP Server support the production environment?

How to install the MCP Server?

Which query languages does the MCP Server support?

Related resources

Official documentation

Learn about the MCP protocol and tools.

GitHub repository

Source code and project description.

Tutorial video

Quick start guide.

🚀 Microsoft Sentinel MCP Server Guide

This guide comprehensively covers the installation, configuration, development, authentication, and troubleshooting of the Microsoft Sentinel MCP Server.

🚀 Quick Start

Installation and Configuration

Installation in Claude Desktop or Other MCP-Compatible Clients

Use the provided PowerShell installation script to set up the MCP server for Claude Desktop or similar environments:

# Run from the root directory of the repository
.\install.ps1

The script will perform the following actions:

Check the installation of Python.
Create a virtual environment and install dependencies.
Perform post-installation configuration steps.
Generate a configuration file for Claude Desktop.
Copy the configuration to the clipboard.

After running the script, you can directly paste the configuration into your MCP client (such as Claude Desktop, Cursor, etc.). The script will generate a configuration for a Claude-compatible MCP server.

Advanced Installation Options

Manual Environment Setup

If you prefer to set up the environment manually:

Configure Environment Variables Copy the provided template and fill in your Azure credentials:

cp .env.example .env
# Edit the .env file and set:
# AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP, AZURE_WORKSPACE_NAME, AZURE_WORKSPACE_ID

Install Dependencies (Using uv)

uv venv
uv pip install -e .

Alternative Server Running Options

Using MCP CLI:

mcp run wrapper.py

Development with Hot Reload:

mcp dev wrapper.py

SSE Mode (for IDEs):

python wrapper.py --sse

Checking the Tool UI

When running with mcp dev wrapper.py, the MCP checking tool UI will be available at http://127.0.0.1:6274.

📚 Documentation

Development Guide

Resources: Add Python files to the resources/ directory and implement a register_resources(mcp) function.
Tools: Add Python files to the tools/ directory and implement a register_tools(mcp) function. Tools must follow the structure defined in docs/tool-architecture-and-implementation-requirements.md.
Prompts: Add prompt templates to the prompts/ directory for LLM-driven workflows.

All components in the resources/, tools/, and prompts/ directories will be automatically discovered and registered when the server starts. There is no need for manual import.

Authentication and Environment Variables

The MCP Server supports any authentication method supported by the DefaultAzureCredential of the Azure Python SDK.

Using Service Principal Authentication Instead of Azure CLI

Set up an application registration in Azure and grant the following roles:

Log Analytics Reader
Microsoft Sentinel Reader

If you wish, you can also grant the following Microsoft Graph permissions to the application registration:

User.Read.All
Group.Read.All

Then, use the following environment variables in your .env file or MCP Server configuration:

AZURE_TENANT_ID
AZURE_CLIENT_ID
AZURE_CLIENT_SECRET
AZURE_SUBSCRIPTION_ID
AZURE_RESOURCE_GROUP
AZURE_WORKSPACE_NAME
AZURE_WORKSPACE_ID

Refer to .env.example for a template.

Using Azure CLI Authentication

az login

If you use Azure CLI authentication, you can omit AZURE_CLIENT_SECRET and AZURE_CLIENT_SECRET from your configuration.

Troubleshooting and Support

If you encounter issues during installation or configuration, refer to the project documentation or contact the support team. You can also seek help through community forums or other resources.