Microsoft Sentinel Data Exploration
com.microsoftPublished by microsoft.comOfficial publisherv1.0.1Updated Oct 24, 2026
Find relevant security data from Sentinel data lake for building effective agents. More:aka.ms/s/de
The publisher's own server: Microsoft Learn MCP
Overview
Remote Microsoft Sentinel MCP server that lets an assistant find relevant tables and retrieve security data from the Sentinel data lake using natural language.
- What you can do
- Search Sentinel data lake tables to find the ones relevant to a question
- Retrieve data from those tables for analysis
- Support natural-language exploration of security telemetry such as sign-in and multi-factor authentication logs
- Provide the data foundation for building security agents that hunt for password spray, impossible travel, MFA failure spikes or dormant account activity
- When to use it
- Use it when you want an assistant or agent to explore Microsoft Sentinel security data in natural language, for example to pick the right tables and pull sign-in or authentication logs for threat-hunting investigations.
- Requirements
- A remote MCP endpoint at sentinel.microsoft.com; no local package or runtime. OAuth 2.0 authentication is required, so a Microsoft Sentinel / Azure account with appropriate access is needed. Any MCP-compatible client can connect.
Installation
In SourceWeft
- Open Microsoft Sentinel Data Exploration in the dashboard and add it to a workspace.
- Connect the required credentials. They are stored privately and never shown on public pages.
- Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.microsoft%2Fsentinel-data-exploration/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Other MCP clients
Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.
{
"mcpServers": {
"microsoft-sentinel-data-exploration": {
"type": "http",
"url": "https://sentinel.microsoft.com/mcp/data-exploration"
}
}
}README
Microsoft Sentinel Data Exploration
INSTALL [Install Microsoft Sentinel Data Exploration MCP in VS Code] [Install Microsoft Sentinel Data Exploration MCP in VS Code Insiders]
The data exploration tool collection in the Microsoft Sentinel MCP server lets you search for relevant tables and retrieve data from Microsoft Sentinel's data lake using natural language.
🌐 The Microsoft Sentinel Data Exploration MCP Server Endpoint
The Microsoft Sentinel Data Exploration MCP Server is accessible to any IDE, agent, or tool that supports the Model Context Protocol (MCP). Any compatible client can connect to the following remote MCP endpoint:
Authentication OAuth 2.0
🧩 Use cases
Password-Spray Hunt Build security agents that autonomously select relevant sign-in tables, aggregates login attempts by user and IP, and flags patterns consistent with password-spray behavior—like low-frequency attempts over several months across many accounts.
Impossible Travel Check Build security agents that correlate sign-in events by user, calculates geodistance and time gaps between logins, and flags cases where travel speed exceeds realistic thresholds, suggesting credential compromise.
Multi-factor authorization failures Build security agents that analyzes multi-factor auth logs to detect spikes in failure rates, clustering by user, IP, or time window, and surfaces anomalies that deviate from baseline behavior over long periods.
Dormant Account wake-up Build security agents that based on inactivity thresholds, scans for accounts with long silence followed by recent activity, and builds a timeline showing when and how these accounts re-engaged.
📚 Learn more
Explore Microsoft Sentinel data lake with data exploration collection
Source: README.md at commit 58db89f
Tools
0Version history
1- v1.0.1LatestSep 16, 2026
Score
85% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 daysRequired25 pts
- Auth declaredRequired10 pts
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts
Other Microsoft integrations
Microsoft Learn MCP
com.microsoftOfficial publisher
A free remote MCP server that lets an AI assistant search official Microsoft Learn documentation, find code samples, and fetch documentation pages as markdown.
Playwright Cloud Browsers
com.microsoftOfficial publisher
Remote MCP server giving AI agents managed Playwright cloud browsers to create sessions, navigate and inspect pages, and interact with elements.
Visio
com.microsoft
Lets an assistant create, update and read Microsoft Visio diagrams by driving the Visio desktop application on the user's Windows machine.
Microsoft Clarity MCP
Published by GitHub account surendranb
Local MCP server that pulls Microsoft Clarity behavioral UX data — rage clicks, dead clicks, quick backs and JS errors — into an AI assistant.
Microsoft Todo Mcp Server
Published by GitHub account jordanburke
Local MCP server that lets an assistant read and manage Microsoft To Do lists, tasks, recurring tasks and checklist items via Microsoft Graph.