English Français العربية

Microsoft Sentinel Data Exploration

Official registry Security

Find relevant security data from Sentinel data lake for building effective agents. More:aka.ms/s/de

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http microsoft-sentinel-data-exploration 'https://sentinel.microsoft.com/mcp/data-exploration'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "microsoft-sentinel-data-exploration": {
            "type": "http",
            "url": "https://sentinel.microsoft.com/mcp/data-exploration"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

# Microsoft Sentinel Data Exploration

INSTALL

The data exploration tool collection in the Microsoft Sentinel MCP server lets you search for relevant tables and retrieve data from Microsoft Sentinel's data lake using natural language.

🌐 The Microsoft Sentinel Data Exploration MCP Server Endpoint

The Microsoft Sentinel Data Exploration MCP Server is accessible to any IDE, agent, or tool that supports the Model Context Protocol (MCP). Any compatible client can connect to the following remote MCP endpoint:

https://sentinel.microsoft.com/mcp/data-exploration

Authentication OAuth 2.0

🧩 Use cases

Password-Spray Hunt Build security agents that autonomously select relevant sign-in tables, aggregates login attempts by user and IP, and flags patterns consistent with password-spray behavior—like low-frequency attempts over several months across many accounts.

Impossible Travel Check Build security agents that correlate sign-in events by user, calculates geodistance and time gaps between logins, and flags cases where travel speed exceeds realistic thresholds, suggesting credential compromise.

Multi-factor authorization failures Build security agents that analyzes multi-factor auth logs to detect spikes in failure rates, clustering by user, IP, or time window, and surfaces anomalies that deviate from baseline behavior over long periods.

Dormant Account wake-up Build security agents that based on inactivity thresholds, scans for accounts with long silence followed by recent activity, and builds a timeline showing when and how these accounts re-engaged.

📚 Learn more

Explore Microsoft Sentinel data lake with data exploration collection

Frequently asked questions

What is Microsoft Sentinel Data Exploration?

Find relevant security data from Sentinel data lake for building effective agents. More:aka.ms/s/de

How do I install Microsoft Sentinel Data Exploration?

It runs as a remote server. In Claude Code: claude mcp add --transport http microsoft-sentinel-data-exploration 'https://sentinel.microsoft.com/mcp/data-exploration'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Microsoft Sentinel Data Exploration need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Microsoft Sentinel Data Exploration open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains Microsoft Sentinel Data Exploration?

It is published by microsoft. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.