Microsoft Sentinel Data Exploration
Explore Microsoft Sentinel lake data through MCP so security-aware agents can find relevant tables and fields for detection or response workflows.
Overview
com.microsoft/sentinel-data-exploration is an Operate-phase MCP server that helps agents find relevant Microsoft Sentinel security lake data via streamable HTTP.
What is this MCP server?
- Remote streamable-http endpoint at sentinel.microsoft.com/mcp/data-exploration
- Version 1.0.1 with GitHub repo sentinel-data-exploration-mcp
- Focused on finding relevant security data in the Sentinel data lake for agents
- Documented entry point aka.ms/s/de for deeper Microsoft guidance
- Server version 1.0.1
- Transport: streamable-http remote URL on sentinel.microsoft.com
- Repository: github.com/microsoft/sentinel-data-exploration-mcp
Community signal: 2 GitHub stars.
What problem does it solve?
Building security agents stalls because engineers cannot quickly map which Sentinel lake data applies to a detection or automation idea.
Who is it for?
Indie builders or tiny teams on Microsoft Sentinel who already operate cloud security telemetry and use MCP for agent development.
Skip if: Non-Azure stacks, hobby apps with no centralized security logging, or beginners without Sentinel admin access.
What do I get? / Deliverables
Agents can explore Sentinel-relevant data context remotely so you draft queries and agent logic with less manual schema hunting.
- Agent-driven discovery of relevant Sentinel security data
- Faster scaffolding for detection and security-agent workflows
Recommended MCP Servers
Journey fit
How it compares
Sentinel-focused remote MCP for data discovery—not a generic SIEM skill or local log tail utility.
Common Questions / FAQ
Who is com.microsoft/sentinel-data-exploration for?
Developers building security or operations agents on Microsoft Sentinel who need MCP-backed data lake exploration.
When should I use com.microsoft/sentinel-data-exploration?
During Operate when designing detections, automations, or agent tools that must reference the right Sentinel tables and fields.
How do I add com.microsoft/sentinel-data-exploration to my agent?
Register the remote MCP URL https://sentinel.microsoft.com/mcp/data-exploration as streamable-http in your agent host and authenticate per Microsoft docs.