Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Data Exploration Tool Collection in Microsoft Sentinel MCP Server

4 September 2026Doc update+55 / −52 lines

In brief

The page was updated with revised wording for data exploration, graph features, setup steps, access requirements, and tool descriptions, along with metadata and formatting changes.

What Defender admins need to know

No administrator action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Data exploration tool collectionExploration Tool Collection in Microsoft Sentinel MCP serverServer titleSuffix: Microsoft Security
description: Learn how to search tables, run KQL queries, analyze entities, and explore graphs by using the data exploration tools in the Microsoft Sentinel MCP server. author: poliveria ms.reviewer: macasgra ms.topic: how-to ms.date: 06/12/07/01/2026 ms.author: pauloliveria ms.service: microsoft-sentinel ms.subservice: sentinel-platform ms.custom: msecd-doc-authoring-10141016 ai-usage: ai-assisted

#customer intent: As a security analyst, I want to know the different tools available to explore security data in Microsoft Sentinel data lake so that I can investigate threats and make data-driven decisions.

The data exploration tools in the Microsoft Sentinel Model Context Protocol (MCP) server let you search for tables and pull data from your data lake with natural language. These tools also include graph features that help you reason over Microsoft Sentinel graphs, such as exposure, hunting, and data risk graphs.

Prerequisites

To access the data exploration tool collection, you need the following prerequisites:

To access the graph data in Defender portal, at least read-only access in Microsoft Security Exposure Management in Microsoft Security Exposure Management is required.

Add the data exploration collection

To add the data exploration collection, firstFirst, set up the Microsoft Sentinel's unified MCP server interface. Followserver. Then follow the step-by-step instructionssetup steps for compatibleyour code editor or agent-building platform.

The data exploration collection is hosted at the following URL:

https://sentinel.microsoft.com/mcp/data-exploration
.

Tools in the data exploration collection

The data exploration collection includes the following tools:

Semantic search on table catalog (search_tables)

The search_tables tool discovers data lake tables relevant to a given natural language input and returns schema definitions to support query authoring. Use this tool to discover tables, understand a schema, or build valid Kusto Query Language (KQL) queries for a Microsoft Sentinel workspace. You can also use it to explore unfamiliar data sources or identify relevant tables for a specific investigative or analytical task.

Parameters Required? Description
query Yes This parameter takes in keywords to search for relevant tables in the connected workspaces.
workspaceId No This parameter takes in a workspace identifier to limit the search to a single connected Microsoft Sentinel data lake workspace.
  • AliCloudActionTrailLogs_CL
  • argsentdc_CL
  • Audit_CL
  • Auth0Logs_CL
  • Awareness_Performance_Details_CL
  • Awareness_SafeScore_Details_CL
  • Awareness_User_Data_CL
  • Awareness_Watchlist_Details_CL
  • CarbonBlack_Alerts_CL
  • Cisco_Umbrella_proxy_CL
  • Cloud_Integrated_CL
  • CloudGuard_SecurityEvents_CL
  • ConfluenceAuditLogs_CL
  • CortexXpanseAlerts_CL
  • CyberSixgill_Alerts_CL
  • DruvaSecurityEvents_CL
  • DynatraceAttacks_CL
  • DynatraceAuditLogs_CL
  • DynatraceProblems_CL
  • DynatraceSecurityProblems_CL
  • ErmesBrowserSecurityEvents_CL
  • FireworkV2_CL
  • Garrison_ULTRARemoteLogs_CL
  • GCPLoadBalancerLogs_CL
  • GitHubAuditLogsV2_CL
  • Health_Data_CL
  • Illumio_Flow_Events_CL
  • IllumioInsightsSummary_CL
  • iocsent_CL
  • Island_Admin_CL
  • Island_User_CL
  • JBossEvent_CL
  • LookoutMtdV2_CL
  • ObsidianActivity_CL
  • ObsidianThreat_CL
  • Onapsis_Defend_CL
  • OneTrustMetadataV3_CL
  • OracleWebLogicServer_CL
  • PaloAltoCortexXDR_Alerts_CL
  • PaloAltoCortexXDR_Audit_Agent_CL
  • PaloAltoCortexXDR_Audit_Management_CL
  • PaloAltoCortexXDR_Endpoints_CL
  • Phosphorus_CL
  • PingOne_AuditActivitiesV2_CL
  • PrismaCloudCompute_CL
  • ProofpointPODMailLog_CL
  • ProofpointPODMessage_CL
  • ProofPointTAPClicksBlockedV2_CL
  • ProofPointTAPMessagesBlockedV2_CL
  • RSAIDPlus_AdminLogs_CL
  • SAPLogServ_CL
  • Seg_Cg_CL
  • Seg_Dlp_CL
  • SeraphicWebSecurity_CL
  • SlackAuditV2_CL
  • Tenable_WAS_Asset_CL
  • TransmitSecurityActivity_CL
  • Ttp_Attachment_CL
  • Ttp_Impersonation_CL
  • Ttp_Url_CL
  • Ubiquiti_CL
  • ValenceAlert_CL
  • vcenter_CL
  • ZimperiumThreatLog_CL
  • ZNSegmentAuditNativePoller_CL

Execute KQL (Kusto Query Language) query on Microsoft Sentinel data lake (query_lake)

The query_lake tool runs a single KQL query against a specified Microsoft Sentinel data lake workspace and returns the raw result set. It's designed for focused investigative or analytical retrieval and not bulk export. Use this tool to advance an investigation or analytical workflow and retrieve a security event, alert, asset, identity, device, or enrichment data. You can also use it alongside the search_tables tool to identify relevant table schemas and build valid KQL queries.

| Parameters | Required? | Description | | query| Yes |This parameter takes in a well-formed KQL query to retrieve data from a Microsoft Sentinel data lake workspace. | | workspaceId| No |This parameter takes in a workspace identifier to limit the search to a single connected Microsoft Sentinel data lake workspace. |

List workspaces (list_sentinel_workspaces)

The list_sentinel_workspaces tool lists all Microsoft Sentinel data lake workspace name and ID pairs available to you. Including the workspace name provides you with helpful context to understand which workspace is being used. Run this tool before using any other Microsoft Sentinel tools because those tools need a workspace ID argument to function properly.

Entity analyzer

For more information, see Understand authentication in Microsoft Security Copilot.

Start analysis (analyze_user_entity and analyze_url_entity)

Use the following parameters to start a user or URL entity analysis job.

  • analyze_user_entity supports a maximum time window of seven days to maximize accuracy of the results.

  • analyze_user_entity only works for users with a Microsoft Entra object ID (users). On-premises Active Directory-only users aren't supported for user analysis.

  • analyze_user_entity requires the following tables to be present in the data lake to ensure accuracy of the analysis:

    If you don't have any of these required tables, analyze_user_entity generates an error message that lists the tables you didn't onboard, along with links to their corresponding onboarding documentation.

  • analyze_user_entity works best when the following tables are also present in the data lake, but continues to work and assess risk, even if these tables are unavailable:

  • analyze_url_entity works best when the following tables are present in the data lake, but continues to work and assess risk, even if these tables are unavailable:

    If you don't have any of these tables, analyze_url_entity generates a response with a disclaimer that lists the tables you didn't onboard, along with links to their corresponding onboarding documentation.

  • Running multiple instances of the entity analyzer at the same time can increase latency for each run. To prevent timeouts and avoid hitting the entity analyzer's entity analyzer preview thresholds, start by running a maximum of five analyses at once and then adjust it as needed based on how often the logic app is triggered in your organization.

    • Graph tools (preview)

    The graph tools let you reason over multiple Microsoft Sentinel graphs, including exposure, hunting, and blast radius graphs. By using these tools, you can gather insights and make data-driven decisions while querying in natural language.

    Blast radius finder (find_blastradius)

    ThisThe find_blastradius tool evaluates the blast radius of a node by exploring propagation paths towards an organization's critical assets. It details the paths that start at the entity you provide, evaluates the risk, and specifies recommendations to reduce it.

    Parameters Required? Description
    sourceName Yes This parameter takes in keywords to search for relevant information matching an entity in the graph. It can be a node or a group of nodes.

    Connection and path discovery (find_walkable_paths)

    This tool enumerates the connections between any given pairs of sources and targets. It analyzes the nature of the connections and then decides whether it can be traversed for lateral movement.

    | Parameters | Required? | Description | | sourceName | Yes |This parameter takes in keywords to match an entity within the graph for the path starting point.| |targetName |Yes |This parameter takes in keywords to match an entity within the graph for the path target. |

    Exposure perimeter analyzer (find_exposure_perimeter)

    This tool lists the incoming connections from other entities to the specified entity. It helps you determine the risk that the entity faces. The tool might return prioritized recommendations based on the results.

    | Parameters | Required? | Description | | maxPathLength | No |This parameter takes in the maximum number of hops in a path. | | resultsCountLimit | No |This parameter takes in the maximum number of paths to return. |

    Path between two entities (find_connected_nodes)

    ThisThe find_connected_nodes tool lists traversable paths between two entities that match a criteria or characteristic that describes those entities.

    Parameters Required? Description

    Nodes match (find_nodes)

    ThisThe find_nodes tool finds and matches entities that the graph represents as nodes based on given criteria or characteristics. It returns a list of nodes that match the defined criteria.

    Parameters Required? Description

    General information and context for graph (get_graph_context)

    ThisThe get_graph_context tool provides context for the parameters and serves as a reference to help you understand which tools, functionalities, or parameters you can use. Use it as a helper to get the graph context so you can better use the other graph MCP tools in the collection.

    Additional information for graph tools

    Keep the following usage notes in mind when working with graph tools:

    • To scope results to graph only, add in my graph to prompts.
    • Querying for identities doesn't support user principal names (UPNs).
    • When you specify the type of the entity, use it before the name.

    Sample prompts

    The following sample prompts demonstrate what you can do with the data exploration collection:

    • Find the top three users that are at risk and explain why they're at risk.
    • Find sign-in failures in the last 24 hours and give me a brief summary of key findings.
    • Identify devices that showed an outstanding number of outgoing network connections.
    • List all paths from user X to critical assets.
    • What is the exposure perimeter of my critical SQL servers?

    How Microsoft Sentinel MCP tools work alongside your agent

    The following example shows how an agent answers a prompt by dynamically orchestrating over the data exploration tools.

    Sample prompt: Find the top three users that are at risk and explain why they're at risk.

    Typical response (GitHub Copilot using Claude Sonnet 4):

    :::image type="content" source="media/sentinel-mcp/mcp-tool-github-response.png" alt-text="Screenshot of a GitHub Copilot response." lightbox="media/sentinel-mcp/mcp-tool-github-response.png":::

    Explanation:

    • When the agent receives the prompt, it searches for relevant tables that contain user risk and security information. It starts by deconstructing the prompt into search keywords to find the tables.

      From the sample prompt, its search identifies four relevant tables from the scope of tables that the user has access to:

      :::image type="content" source="media/sentinel-mcp/mcp-tool-search-table.png" alt-text="Screenshot of the agent searching for relevant tables that contain user risk and security information." lightbox="media/sentinel-mcp/mcp-tool-search-table.png":::

    • The agent does anotherruns a broader search by usingwith the Semantic search on table catalog (search_tables) tool, this time with broader terms,tool. This step finds more tables to find other tables that it should query data from to influencehelp shape its reasoning.

      :::image type="content" source="media/sentinel-mcp/mcp-tool-semantic-search.png" alt-text="Screenshot of the agent searching using broader terms." lightbox="media/sentinel-mcp/mcp-tool-semantic-search.png":::

    • TheAfter finding the right tables, the agent identifies the relevant tables and then uses the Execute KQL (Kusto Query Language) query on Microsoft Sentinel data lake (query_lake) tool to query for data and findlook up the top three users at risk. The first attemptquery fails because the KQL query hasdue to a semantic error.

      :::image type="content" source="media/sentinel-mcp/mcp-tool-run-kql.png" alt-text="Screenshot of the agent attempting to run a KQL query with a semantic error." lightbox="media/sentinel-mcp/mcp-tool-run-kql.png":::

    • The agent responds back to the user with its comprehensive analysis.

    Related content