Microsoft Sentinel MCP Server
About
MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.
Details
- Author
- dstreefkerk
- Downloads
- 441
- Categories
- Search, Security
Jump to
- Execute and validate KQL queries, including mock data testing
- List and view Log Analytics workspace tables and schemas
- List, view, and analyze security incidents
- Access analytics rules, rule templates, and hunting queries
- List data connectors, watchlists, and threat intelligence data
- View Entra ID users, groups, and RBAC role assignments
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Microsoft Sentinel MCP ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Authenticate with Azure CLI (az login), clone the repository, run the PowerShell installation script (.\install.ps1) to create a virtual environment, install dependencies, and generate a client configuration file. Then paste the configuration into an MCP‑compatible client (e.g., Claude Desktop, Cursor). Alternatively, set environment variables for service principal authentication and run manually with mcp run wrapper.py.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"microsoft sentinel mcp server": {
"ms-sentinel-mcp-server": {
"command": "uv",
"args": [
"venv"
]
}
}
}
}McpServers
{
"ms-sentinel-mcp-server": {
"command": "uv",
"args": [
"venv"
]
}
}Microsoft Sentinel MCP Server
A [Model Context Protocol][mcp] (MCP) server for Microsoft Sentinel. This server enables read-only access to a Microsoft Sentinel instance, including advanced querying, incident viewing, and resource exploration for Azure Sentinel environments. It provides a modular and extensible platform for observation-only security operations and analysis.
---
⚠️ IMPORTANT SECURITY NOTICE ⚠️
TEST ENVIRONMENTS ONLY: This Microsoft Sentinel MCP server only supports read-only operations and is intended exclusively for TEST environments. It is not intended to be connected to production Sentinel instances.
PRIVACY WARNING: Connecting this server to a production Microsoft Entra ID (Azure AD) or Sentinel environment may expose sensitive user and directory data to LLM operators or public LLMs. Use only with non-production/test tenants, or a private LLM with MCP support.
SECURITY WARNING: Connecting a production Microsoft Sentinel instance to a public LLM poses significant privacy and security risks. Use only private, secured environments for production security operations.
---
✨ Features
- KQL Query Execution: Run and validate KQL queries, test with mock data
- Log Analytics Management: Workspace info, table listings and schemas
- Security Incidents: List and view detailed incident information
- Analytics Rules: List, view, and analyze by MITRE tactics/techniques
- Rule Templates: Access and analyze templates by MITRE framework
- Hunting Queries: List, view details, and analyze by tactic
- Data Connectors: List and view connector details
- Watchlists: Manage watchlists and their items
- Threat Intelligence: Domain WHOIS and IP geolocation lookups
- Metadata & Source Control: List and view repository details
- ML Analytics: Access ML analytics settings
- Authorization: View RBAC role assignments
- Entra ID Users & Groups: View user and group details from Microsoft Entra ID
---
🚀 Quick Start
1. Authenticate with Azure CLI
Before using the MCP server, you must have authenticated to Azure with an account that has access to a Microsoft Sentinel workspace:
az login
2. Clone the Repository
git clone https://github.com/dstreefkerk/ms-sentinel-mcp-server.git
cd ms-sentinel-mcp-server
3. Install with PowerShell Script (Recommended)
Use the provided PowerShell installation script to set up the MCP server:
```powershell
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
