Sentinel Solutions

You can use the Sentinel Solutions MCP Server to analyze Microsoft Sentinel solutions from any GitHub repository and map data connectors to Log Analytics tables. It lets you query official or private solution repos, keeps data current directly from GitHub, and serves results instantly with a pre-built index for fast initial responses.

How to use

You run the MCP server locally or connect to it through an MCP client. Use it to analyze Sentinel content from any GitHub repository, fetch relevant Log Analytics table mappings, and query content types such as detections, workbooks, hunting queries, playbooks, parsers, and more. Your MCP client can request full analysis of solutions, or filter to specific content like data connectors, tables, or individual items.

How to install

Prerequisites: Node.js (recommended 14.x+ or 16.x+), npm, and optionally npx.

# Run with npx (recommended - instant startup with pre-built index)
npx 

# Or install globally
npm install -g sentinel-solutions-mcp

Configuration and usage notes

The MCP server is designed to start quickly and work with an MCP client. You can configure a local runtime using the provided command and arguments for starting the server via npx. If you need to integrate with Claude Desktop or another agent, you can reference the server via an MCP configuration snippet.

{
  "mcpServers": {
    "sentinel_solutions": {
      "command": "npx",
      "args": ["sentinel-solutions-mcp"]
    }
  }
}

Troubleshooting and tips

If you encounter GitHub API rate limits or want to run against a private repository, you can supply a GitHub token to increase quota and ensure smooth live queries.

export MCP_GITHUB_TOKEN=your_token_here

Available tools

analyze_solutions

Performs a full analysis of all Sentinel solutions with complete connector-table mappings.

get_connector_tables

Retrieves Log Analytics tables for a specific connector.

search_solutions

Searches solutions by name, publisher, or support tier.

get_solution_details

Provides comprehensive details about a specific solution.

list_tables

Lists all Log Analytics tables across all sources.

validate_connector

Validates a connector JSON and extracts its table mappings.

list_detections

Enumerates detections with MITRE ATT&CK mappings.

get_detection_details

Shows detailed information for a specific detection rule.

list_workbooks

Lists workbooks and their visualizations.

get_workbook_details

Provides detailed information about a particular workbook.

list_hunting_queries

Lists threat hunting queries.

list_playbooks

Lists automation playbooks (Logic Apps) available in the content.

list_parsers

Lists KQL parsers and saved functions.

list_watchlists

Lists watchlist definitions.

list_notebooks

Lists Jupyter notebooks available in the content.

list_exploration_queries

Lists exploration queries.

list_functions

Lists saved KQL functions.

list_asim_content

Lists ASIM (Advanced Security Information Model) content.

list_summary_rules

Lists summary rules.

list_tools

Lists Sentinel tools and utilities.

list_tutorials

Lists learning resources and tutorials.

list_dashboards

Lists Sentinel dashboards.

list_data_connectors

Lists data connector definitions.