Gives agents read access to Microsoft Sentinel logs, incidents, analytics and Entra ID data. Intended for non-production use.
Setup
This project documents no single launch command; follow its repository instructions.
Microsoft Sentinel MCP Server
dstreefkerk
Related
More- SSecurity Copilot MCP ServerjguimeraIntegrates with Microsoft Security Copilot and Sentinel to help develop, test and upload Security Copilot artifacts.Security23 Repository stars
- PPanther MCPPanther LabsOfficialUse Panther's SIEM from AI agents to write detections, investigate alerts and query logs.Security47 Repository stars
- WWazuh MCP ServergensecaihqWazuh SIEM tools for alert triage, threat hunting, vulnerability management, compliance checks and active response.Security257 Repository stars
- WWazuh MCP ServergbrigandiAccess real-time security alerts and event data from Wazuh SIEM.Security240 Repository stars
- RROADrecon MCP ServeratomicchonkAnalyzes ROADrecon data gathered from Azure tenant enumeration so agents can review tenant enumeration results.Security53 Repository stars
- EEntraID MCP ServerhieuttmmoManages Entra ID (Azure AD) users, groups, applications, sign-in logs and MFA status through the Microsoft Graph API.Security41 Repository stars