Microsoft Sentinel Data Exploration — Claude Code MCP server
Search Microsoft Sentinel data lake tables and retrieve data with natural-language requests. Useful when an agent needs security data for sign-in investigations.
claude mcp add --transport http sentinel-data-exploration https://sentinel.microsoft.com/mcp/data-explorationWhat Microsoft Sentinel Data Exploration does
This MCP server lets an agent look for relevant Microsoft Sentinel tables and fetch records from the data lake through natural-language requests. Connect a compatible client, such as Claude Code, to the remote endpoint https://sentinel.microsoft.com/mcp/data-exploration.
The collection supports agent workflows for investigating password-spray patterns, unusual sign-in travel, multi-factor authentication failures, and recently active dormant accounts. These are investigation scenarios, not ready-made detections. OAuth 2.0 is required, so the client must authenticate before accessing the service.
What it helps with
- locate Sentinel tables for sign-in investigations
- retrieve records for a password-spray hunt
- compare sign-ins by user, time, and location
- spot spikes in multi-factor authentication failures
- trace recent activity on dormant accounts
Example prompts for the agent
- Find Microsoft Sentinel tables for a password-spray investigation and retrieve relevant records.
- Compare a user's sign-ins by time and location to check for impossible travel.
- Look for a rise in multi-factor authentication failures and group the events by user and IP.
How to install Microsoft Sentinel Data Exploration
Platform CLI: remote server
claude mcp add --transport http sentinel-data-exploration https://sentinel.microsoft.com/mcp/data-explorationPlatform CLI: remote server
codex mcp add microsoft-sentinel-data-exploration --url https://sentinel.microsoft.com/mcp/data-explorationConfig file
{
"mcpServers": {
"microsoft-sentinel-data-exploration": {
"url": "https://sentinel.microsoft.com/mcp/data-exploration"
}
}
}Config file
{
"servers": {
"microsoft-sentinel-data-exploration": {
"type": "http",
"url": "https://sentinel.microsoft.com/mcp/data-exploration"
}
}
}Platform CLI: remote server
gemini mcp add -t http microsoft-sentinel-data-exploration https://sentinel.microsoft.com/mcp/data-explorationStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Microsoft Sentinel Data Exploration
How do I install Microsoft Sentinel Data Exploration in Claude Code?
Run claude mcp add --transport http sentinel-data-exploration https://sentinel.microsoft.com/mcp/data-exploration. An alternative server name is microsoft-sentinel-data-exploration.
What does Microsoft Sentinel Data Exploration do?
It helps an MCP-compatible agent find relevant Microsoft Sentinel tables and retrieve data from the data lake using natural-language requests.
What authentication does the server use?
The remote MCP endpoint uses OAuth 2.0 authentication.
