Explore Microsoft Sentinel data lake with data exploration collection

The data exploration tool collection in the Microsoft Sentinel Model Context Protocol (MCP) server lets you search for relevant tables and retrieve data from Microsoft Sentinel's data lake by using natural language. It also includes graph tools that let you reason over multiple Microsoft Sentinel graphs, including exposure, hunting, and data risk graphs.

Prerequisites

To access the data exploration tool collection, you need the following prerequisites:

• Microsoft Sentinel data lake and graph
• Microsoft Sentinel data lake onboarded to Defender portal (required for graph tools)
• Any of the supported AI-powered code editors and agent-building platforms:
  • Microsoft Security Copilot
  • Microsoft Copilot Studio
  • Microsoft Foundry
  • Visual Studio Code

To access the graph data in Defender portal, at least read-only access in Microsoft Security Exposure Management is required.

Add the data exploration collection

To add the data exploration collection, first set up Microsoft Sentinel's unified MCP server interface. Follow the step-by-step instructions for compatible AI-powered code editors and agent-building platforms.

The data exploration collection is hosted at the following URL:

https://sentinel.microsoft.com/mcp/data-exploration

Tools in the data exploration collection

The data exploration collection includes the following tools:

• Semantic search on table catalog — Discover relevant data lake tables and their schemas.
• Execute KQL query — Run KQL queries against a Microsoft Sentinel data lake workspace.
• List workspaces — List all available Microsoft Sentinel data lake workspaces.
• Entity analyzer — Analyze users and URLs with AI-driven risk verdicts and insights.
• Graph tools (preview) — Reason over exposure, hunting, and data risk graphs.

Semantic search on table catalog (search_tables)

This tool discovers data lake tables relevant to a given natural language input and returns schema definitions to support query authoring. Use this tool to discover tables, understand a schema, or build valid Kusto Query Language (KQL) queries for a Microsoft Sentinel workspace. You can also use it to explore unfamiliar data sources or identify relevant tables for a specific investigative or analytical task.

Supported tables

This tool supports nearly all known standard and partner content hub tables out of the box, including Azure Monitor Log Analytics tables organized by category and most Microsoft Sentinel tables and associated connectors.

The following Microsoft Sentinel tables aren't supported:

Execute KQL (Kusto Query Language) query on Microsoft Sentinel data lake (query_lake)

This tool runs a single KQL query against a specified Microsoft Sentinel data lake workspace and returns the raw result set. It's designed for focused investigative or analytical retrieval and not bulk export. Use this tool to advance an investigation or analytical workflow and retrieve a security event, alert, asset, identity, device, or enrichment data. You can also use it alongside the search_tables tool to identify relevant table schemas and build valid KQL queries.

List workspaces (list_sentinel_workspaces)

This tool lists all Microsoft Sentinel data lake workspace name and ID pairs available to you. Including the workspace name provides you with helpful context to understand which workspace is being used. Run this tool before using any other Microsoft Sentinel tools because those tools need a workspace ID argument to function properly.

Entity analyzer

These tools use AI to analyze your organization's data in the Microsoft Sentinel data lake. They provide a verdict and detailed insights on URLs, domains, and user entities. They help eliminate the need for manual data collection and complex integrations typically required for enriching and investigating entities.

For example, analyze_user_entity reasons over the user's authentication patterns, behavioral anomalies, activity within your organization, and more to provide a verdict and analysis. The analyze_url_entity tool reasons over Microsoft threat intelligence, your custom threat intelligence in Microsoft Sentinel threat intelligence platform (TIP), and URL activity within your organization. It also checks Microsoft Sentinel watchlists to provide a verdict and analysis.

Entity analysis tools might require a few minutes to generate results, so there are tools to start analysis for each entity and another one that polls for the analysis results.

Start analysis (analyze_user_entity and analyze_url_entity)

These tools return an identifier value that you can provide to the retrieve analysis tool as input.

Retrieve analysis (get_entity_analysis)

While this tool automatically polls for a few minutes until results are ready, its internal timeout might not be sufficient for long analysis operations. You might need to run it multiple times to get results.

Additional information

• analyze_user_entity supports a maximum time window of seven days to maximize accuracy of the results.

• analyze_user_entity only works for users with a Microsoft Entra object ID (users). On-premises Active Directory-only users aren't supported for user analysis.

• analyze_user_entity requires the following tables to be present in the data lake to ensure accuracy of the analysis:

  • AlertEvidence
  • SigninLogs
  • CloudAppEvents
  • IdentityInfo (Available only for tenants with Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, or Microsoft Defender for Endpoint P2 licensing)

  If you don't have any of these required tables, analyze_user_entity generates an error message that lists the tables you didn't onboard, along with links to their corresponding onboarding documentation.

• analyze_user_entity works best when the following tables are also present in the data lake, but continues to work and assess risk, even if these tables are unavailable:

  • AADNonInteractiveUserSignInLogs
  • BehaviorAnalytics

• analyze_url_entity works best when the following tables are present in the data lake, but continues to work and assess risk, even if these tables are unavailable:

  • EmailUrlInfo
  • UrlClickEvents
  • ThreatIntelIndicators
  • Watchlist
  • DeviceNetworkEvents

  If you don't have any of these tables, analyze_url_entity generates a response with a disclaimer that lists the tables you didn't onboard, along with links to their corresponding onboarding documentation.

• Running multiple instances of the entity analyzer at the same time can increase latency for each run. To prevent timeouts and avoid hitting the entity analyzer's preview thresholds, start by running a maximum of five analyses at once and then adjust it as needed based on how often the logic app is triggered in your organization.

Graph tools (preview)

The graph tools let you reason over multiple Microsoft Sentinel graphs, including exposure, hunting, and blast radius graphs. By using these tools, you can gather insights and make data-driven decisions while querying in natural language.

Blast radius finder (find_blastradius)

This tool evaluates the blast radius of a node by exploring propagation paths towards an organization's critical assets. It details the paths that start at the entity you provide, evaluates the risk, and specifies recommendations to reduce it.

Connection and path discovery (find_walkable_paths)

This tool enumerates the connections between any given pairs of sources and targets. It analyzes the nature of the connections and then decides whether it can be traversed for lateral movement.

Exposure perimeter analyzer (find_exposure_perimeter)

This tool lists the incoming connections from other entities to the specified entity. It helps you determine the risk that the entity faces. The tool might return prioritized recommendations based on the results.

Path between two entities (find_connected_nodes)

This tool lists traversable paths between two entities that match a criteria or characteristic that describes those entities.

Nodes match (find_nodes)

This tool finds and matches entities that the graph represents as nodes based on given criteria or characteristics. It returns a list of nodes that match the defined criteria.

General information and context for graph (get_graph_context)

This tool provides context for the parameters and serves as a reference to help you understand which tools, functionalities, or parameters you can use. Use it as a helper to get the graph context so you can better use the other graph MCP tools in the collection.

Additional information for graph tools

• To scope results to graph only, add in my graph to prompts.
• Querying for identities doesn't support user principal names (UPNs).
• When you specify the type of the entity, use it before the name.
• Installing and configuring the graph tool collection carries no cost. However, you invoke the graph meter when you start using the tools to query a Microsoft Sentinel graph. For more information, see: Plan costs and understand Microsoft Sentinel pricing and billing.

Sample prompts

The following sample prompts demonstrate what you can do with the data exploration collection:

• Find the top three users that are at risk and explain why they're at risk.
• Find sign-in failures in the last 24 hours and give me a brief summary of key findings.
• Identify devices that showed an outstanding number of outgoing network connections.
• Help me understand if the user <user object ID> is compromised.
• Investigate users with a password spray alert in the last seven days and tell me if any of them are compromised.
• Find all the URL IOCs from <threat analytics report> and analyze them to tell me everything Microsoft knows about them.
• What is the blast radius of node X if compromised?
• List all paths from user X to critical assets.
• What is the exposure perimeter of my critical SQL servers?

How Microsoft Sentinel MCP tools work alongside your agent

The following example shows how an agent answers a prompt by dynamically orchestrating over the tools.

Sample prompt: Find the top three users that are at risk and explain why they're at risk.

Typical response (GitHub Copilot using Claude Sonnet 4):

Explanation:

• When the agent receives the prompt, it searches for relevant tables that contain user risk and security information. It starts by deconstructing the prompt into search keywords to find the tables.

  From the sample prompt, its search identifies four relevant tables from the scope of tables that the user has access to:

  • AADNonInteractiveUserSignInLogs - Non-interactive Microsoft Entra ID sign-in events
  • BehaviorAnalytics - User and Entity Behavior Analytics (UEBA) data
  • SigninLogs - Interactive Microsoft Entra ID sign-in events
  • AADUserRiskEvents - Identity protection risk detections

  

• The agent does another search by using the Semantic search on table catalog (search_tables) tool, this time with broader terms, to find other tables that it should query data from to influence its reasoning.

  

• The agent identifies the relevant tables and then uses the Execute KQL (Kusto Query Language) query on Microsoft Sentinel data lake (query_lake) tool to query for data and find the top three users at risk. The first attempt fails because the KQL query has a semantic error.

  

• The agent corrects the KQL query by itself and successfully retrieves data from Microsoft Sentinel data lake, finding the risky users.

  

• The agent runs one more query to get detailed information about the risky users to provide better context on why they're at risk.

  

• The agent responds back to the user with its comprehensive analysis.

Related content

• What is Microsoft Sentinel's support for Model Context Protocol (MCP)?
• Get started with Microsoft Sentinel MCP server