@dstreefkerk
基本情報
MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.
以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。
{
"mcpServers": {
"ms-sentinel-mcp-server": {
"command": "uv",
"args": [
"venv"
]
}
}
}ツール一覧はまだありません
この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。
ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。
A Model Context Protocol (MCP) server that provides read‑only access to a Microsoft Sentinel instance, including advanced KQL querying, incident viewing, and resource exploration for Azure Sentinel environments. It is designed for observation‑only security operations and analysis in test environments only.
Authenticate with Azure CLI (az login), clone the repository, run the PowerShell installation script (.\install.ps1) to create a virtual environment, install dependencies, and generate a client configuration file. Then paste the configuration into an MCP‑compatible client (e.g., Claude Desktop, Cursor). Alternatively, set environment variables for service principal authentication and run manually with mcp run wrapper.py.
No. This server is intended only for test environments. Connecting it to a production Sentinel instance or production Microsoft Entra ID may expose sensitive user and directory data to LLM operators or public LLMs. Use only with non‑production/test tenants or a private LLM.
It supports any method compatible with the Azure Python SDK’s `DefaultAzureCredential`, including Azure CLI authentication and service principal authentication via environment variables (`AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`). The service principal should be assigned roles like `Log Analytics Reader` and `Microsoft Sentinel Reader`.
All operations are read‑only. You can run KQL queries, list and view incidents, analytics rules, rule templates, hunting queries, data connectors, watchlists, metadata, source controls, ML analytics settings, Entra ID users/groups, and threat intelligence (domain WHOIS, IP geolocation). No write or modify actions are available.
You need a Microsoft Sentinel workspace in Azure (test tenant only), Python installed, and either the Azure CLI authenticated or service principal credentials configured. The server also requires a Log Analytics workspace with the Sentinel resource provider registered.
Yes, the server can be run in SSE mode for use with IDEs by executing `python wrapper.py --sse`. It also supports the standard MCP stdio transport and can be run in development mode with hot reload (`mcp dev wrapper.py`).
Check one exact Gold Coast or Brisbane City property address. Free address/coverage check and short summary; paid structured Agent JSON adds available building, street and surrounding context, with Brisbane routed journe
The real-time social data source for AI. Public posts, comments, profiles, search and trends from TikTok, Instagram, YouTube, Reddit, X, Xiaohongshu, Douyin, Weibo, Amazon reviews, Google Maps and more: 157 platforms in
Read public Instagram profiles and post feeds by handle in Claude, Cursor, and other MCP clients. Get follower counts, captions, hashtags, mentions, and engagement counts as structured JSON.
Explore GitHub Actions job performance, compute costs and failures with Runzumi’s remote MCP server. Connect securely with OAuth and query the workspaces and repositories you can access.
US rental listings for AI assistants: free live search and rent statistics, plus licensed feeds.
コメント