# Microsoft Sentinel Data Exploration

Search Microsoft Sentinel data lake tables and retrieve data with natural-language requests. Useful when an agent needs security data for sign-in investigations.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1
- Author: microsoft
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/microsoft/sentinel-data-exploration-mcp
- Updated: 2026-01-14
- HTML: https://affpapa.org/en/nevibecode/mcp/microsoft-sentinel-data-exploration

## What it does

This MCP server lets an agent look for relevant Microsoft Sentinel tables and fetch records from the data lake through natural-language requests. Connect a compatible client, such as Claude Code, to the remote endpoint `https://sentinel.microsoft.com/mcp/data-exploration`.

The collection supports agent workflows for investigating password-spray patterns, unusual sign-in travel, multi-factor authentication failures, and recently active dormant accounts. These are investigation scenarios, not ready-made detections. OAuth 2.0 is required, so the client must authenticate before accessing the service.

## Requirements
- Remote server: `https://sentinel.microsoft.com/mcp/data-exploration`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http sentinel-data-exploration https://sentinel.microsoft.com/mcp/data-exploration
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add microsoft-sentinel-data-exploration --url https://sentinel.microsoft.com/mcp/data-exploration
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "microsoft-sentinel-data-exploration": {
            "url": "https://sentinel.microsoft.com/mcp/data-exploration"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "microsoft-sentinel-data-exploration": {
            "type": "http",
            "url": "https://sentinel.microsoft.com/mcp/data-exploration"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http microsoft-sentinel-data-exploration https://sentinel.microsoft.com/mcp/data-exploration
```

## When to use it
- locate Sentinel tables for sign-in investigations
- retrieve records for a password-spray hunt
- compare sign-ins by user, time, and location
- spot spikes in multi-factor authentication failures
- trace recent activity on dormant accounts

## Example prompts
- Find Microsoft Sentinel tables for a password-spray investigation and retrieve relevant records.
- Compare a user's sign-ins by time and location to check for impossible travel.
- Look for a rise in multi-factor authentication failures and group the events by user and IP.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md