Prompt Books - Microsoft Sentinel MCP prompts for GitHub Copilot

July 30, 2026 ยท View on GitHub

Reference for the 18 prompt books under Content/PromptBooks/: what each demonstrates, the MCP tools behind them, how to set them up, the running orders for a live demo, and the failure modes worth knowing before you present.

These are demo assets, not deployable Sentinel content. Nothing here is picked up by the deploy pipelines.

What the Sentinel MCP server is

Microsoft Sentinel exposes scenario-focused collections of MCP tools over a hosted server, authenticated with Microsoft Entra. Connect a compatible client (VS Code with GitHub Copilot, Security Copilot, Copilot Studio, Microsoft Foundry) and you can query security data in natural language without writing KQL or knowing the schema.

Three collections, three endpoints:

CollectionEndpointWhat it does
Data explorationhttps://sentinel.microsoft.com/mcp/data-explorationSearch tables, query the lake, analyse entities, reason over graphs
Triagehttps://sentinel.microsoft.com/mcp/triageIncidents, alerts, Defender entity APIs, advanced hunting
Agent creationhttps://sentinel.microsoft.com/mcp/security-copilot-agent-creationBuild and deploy Security Copilot agents

Setup

1. Register the MCP servers

Copy the shipped template to the git-ignored VS Code folder:

cp Content/PromptBooks/mcp.json .vscode/mcp.json

Reload VS Code and sign in when prompted. Alternatively, Ctrl+Shift+P -> MCP: Add Server -> HTTP -> paste an endpoint URL -> give it a server ID.

.vscode/ is git-ignored in this repo (see .gitignore line 5), which is why the template lives under Content/PromptBooks/ and gets copied rather than being committed in place.

2. Make the prompts discoverable

Merge vscode-settings.snippet.json into .vscode/settings.json. VS Code only looks in .github/prompts by default, so without chat.promptFilesLocations the /slash-commands will not appear.

If settings.json IntelliSense objects to the shape, check the Settings UI for what your VS Code build expects. The key name is stable; the value shape has moved across releases. Copy-paste out of the prompt files always works as a fallback.

3. Agent mode

MCP tools are only available in agent mode. Confirm with the Configure Tools icon that the Sentinel servers appear with their tools listed.

Catalogue

Data exploration (7)

PromptTools exercisedCost
lake-orientationlist_sentinel_workspaces, search_tablesFree
risky-user-huntsearch_tables, query_lakeFree
signin-failure-triagesearch_tables, query_lakeFree
analyze-user-entityanalyze_user_entity, get_entity_analysisSCUs
analyze-url-entityanalyze_url_entity, get_entity_analysisSCUs
retro-hunt-ioc-sweepsearch_tables, query_lakeFree
exposure-blast-radiusget_graph_context, find_blastradius, find_walkable_paths, find_exposure_perimeterGraph meter

Triage (6)

PromptTools exercised
incident-queue-triageListIncidents, GetIncidentById
incident-deep-diveGetIncidentById, ListAlerts, GetAlertByID, RunAdvancedHuntingQuery
file-hash-investigationGetDefenderFileInfo, GetDefenderFileStatistics, GetDefenderFileAlerts, GetDefenderFileRelatedMachines
device-investigationGetDefenderMachine, GetDefenderMachineAlerts, GetDefenderMachineLoggedOnUsers, GetDefenderMachineVulnerabilities
user-investigationListUserRelatedAlerts, ListUserRelatedMachines
cve-exposure-sweepListDefenderMachinesByVulnerability, ListDefenderRemediationActivities

Agent creation (2)

PromptTools exercised
build-triage-agentsearch_for_tools, start_agent_creation, compose_agent, get_evaluation, deploy_agent
post-incident-report-agentSame chain, on Microsoft's own sample scenario

Sentinel-As-Code (3)

MCP plus this repository. These are the ones that make the demo about this repo rather than about Sentinel generally.

PromptWhat it does
hunt-to-analytical-ruleValidates a lake finding, then writes it as rule YAML matching this repo's schema, regenerates dependencies.json and runs the Pester suite
validate-rule-against-lakeChecks a committed rule's tables, columns, 30-day fire count and entity-mapping null rates against real data
detection-gap-analysisSplits coverage gaps into fixable, false-confidence and honest

Tool reference

Data exploration collection

ToolPurposeKey parameters
list_sentinel_workspacesWorkspace name and ID pairs. Run before anything else.-
search_tablesSemantic search over the table catalogue, returns schemasquery, workspaceId
query_lakeRun one KQL query against a lake workspacequery, workspaceId
analyze_user_entityStart an AI risk analysis for a userEntra object ID, startTime, endTime, workspaceId
analyze_url_entityStart an AI risk analysis for a URL or domainURL, startTime, endTime, workspaceId
get_entity_analysisPoll for analysis resultsanalysisId
get_graph_contextValid node labels and properties. Run before other graph tools.-
find_blastradiusPropagation paths from a node towards critical assetssourceName
find_walkable_pathsTraversable connections between a source and targetsourceName, targetName
find_exposure_perimeterIncoming connections to an entitytargetName, minPathLength, maxPathLength
find_connected_nodesPaths between entities matching label criteriasourceNodeLabel, targetNodeLabel
find_nodesEntities matching criteriavalidNodeLabel, validNodeProperties

Triage collection

Incidents and alerts: ListIncidents, GetIncidentById, ListAlerts, GetAlertByID.

Hunting: FetchAdvancedHuntingTablesOverview, FetchAdvancedHuntingTablesDetailedSchema, RunAdvancedHuntingQuery. Run the schema tool before writing KQL; it is the documented way to avoid malformed queries.

Files: GetDefenderFileInfo, GetDefenderFileStatistics, GetDefenderFileAlerts, GetDefenderFileRelatedMachines.

Devices: GetDefenderMachine, GetDefenderMachineAlerts, GetDefenderMachineLoggedOnUsers, GetDefenderMachineVulnerabilities, FindDefenderMachineByIp.

Users: ListUserRelatedAlerts, ListUserRelatedMachines.

Vulnerabilities and remediation: ListDefenderMachinesByVulnerability, ListDefenderVulnerabilitiesBySoftware, ListDefenderRemediationActivities, GetDefenderRemediationActivity.

Indicators and investigations: ListDefenderIndicators, ListDefenderInvestigations, GetDefenderInvestigation, GetDefenderIpAlerts, GetDefenderIpStatistics.

Agent creation collection

search_for_tools, start_agent_creation, compose_agent, get_evaluation, deploy_agent.

Pass compose_agent the session ID from start_agent_creation, not the one from search_for_tools. They are different sessions.

Prerequisites

Data explorationTriageAgent creation
Sentinel data lakeRequired--
Defender portal onboardingGraph tools onlyRequired-
Security CopilotEntity analyser only-Required
Minimum roleSecurity ReaderYour existing permissionsSecurity Copilot access
Extra rolesSecurity Copilot Contributor for entity analyser; Exposure Management read for graph--

Writing good prompts

Microsoft's own guidance is to be specific, and their contrast makes the point better than any rule:

For user <UPN>, baseline their network, file, sign-in, and device events over 90 days and compare with +/- 10 minutes to find anomalies or suspicious activities to help me triage the severity and priority of this alert.

beats

What is risky about <UPN>?

Four incantations that change behaviour, all documented:

Say thisBecause
The workspace ID, explicitlyWith several workspaces connected, tools pick between them turn to turn
in my graphScopes graph tools to the graph rather than the lake
render the results as returned exactly from the toolStops the client re-summarising an entity-analyser verdict
Use 'default' as the workspaceId.System tables have no workspace ID of their own

Two more that are not Microsoft's but earn their place in every prompt in this book:

  • Ask for the reasoning, not just the answer. "Show me each KQL query you run" turns a black box into a demo.
  • Force a commitment. "Commit to one verdict and justify it" beats a model hedging across every option, which is the default failure mode on ambiguous evidence.

Running orders

15 minutes, mixed audience

  1. lake-orientation - no schema knowledge needed
  2. risky-user-hunt - the model writes, breaks and fixes its own KQL
  3. analyze-user-entity - one call replaces twenty minutes of context gathering
  4. hunt-to-analytical-rule - and the finding becomes a pull request

30 minutes, SOC audience

  1. lake-orientation
  2. incident-queue-triage - it disagrees with your severities
  3. incident-deep-dive - on whatever it ranked first
  4. file-hash-investigation or device-investigation - follow the evidence
  5. analyze-user-entity - the verdict
  6. retro-hunt-ioc-sweep - have we ever seen this, not have we seen this recently

30 minutes, detection engineering audience

  1. lake-orientation
  2. detection-gap-analysis - the false-confidence gap usually lands hardest
  3. validate-rule-against-lake - on whatever it flagged
  4. hunt-to-analytical-rule - close the loop
  5. build-triage-agent - if Security Copilot is provisioned

Cost-sensitive demo: stay in the data exploration collection and skip analyze-user-entity, analyze-url-entity (SCUs) and exposure-blast-radius (graph meter). Everything else is free.

Troubleshooting

SymptomCauseFix
Unknown tool '<server>/*' will be ignored in a prompt filetools: frontmatter naming an MCP server that is not registeredThe shipped files carry no tools: key for this reason. If you added one, register the server with that exact ID or drop the line.
Tools never get calledOverlapping tools, weak model, or context favoured over tool useDisable collections you are not using; pick a newer reasoning model; start a fresh chat
Results come from the wrong workspaceSeveral workspaces connectedName the workspace ID in the prompt
Intermittent HTTP 404 Resource not foundToken refresh bugRemove the MCP server, restart VS Code, add it again
Consistent HTTP 404 when adding the serverTenant not registered, or no data lake workspace accessCheck data lake onboarding and your role
HTTP 403 Unauthorized to access accountClient does not support MCP authUpdate VS Code
No results at allTable absent, query too narrow, invalid workspace ID, or missing permissionBroaden the search; re-run list_sentinel_workspaces; check Lake explorer
Guest sign-in authenticates against the wrong tenantKnown VS Code issue; triage tools do not support multi-tenancyAdd an x-mcp-client-tenant-id header to the server definition, or use a home-tenant account
Default workspace missing from the listSystem tables have no workspace IDAdd Use 'default' as the workspaceId. to the prompt

To collect evidence for a support case, use the VS Code Chat Debug View (three dots in the Copilot chat sidebar -> Show Chat Debug View -> Export All as JSON).

Known limits

Entity analyser

  • analyze_user_entity caps the analysis window at seven days
  • Entra object IDs only. On-premises-only AD users are unsupported.
  • Requires AlertEvidence, SigninLogs, CloudAppEvents and IdentityInfo in the lake
  • Run at most five analyses concurrently

Triage collection

  • Cannot query the data lake. Use the data exploration collection for long history.
  • Cannot choose a workspace
  • No guest or delegated access; home tenant only
  • File tools disagree on hash types: GetDefenderFileInfo and GetDefenderFileStatistics take SHA-1 or SHA-256; GetDefenderFileAlerts and GetDefenderFileRelatedMachines take SHA-1 only. MD5 works nowhere. Supply SHA-1 when chaining.

Graph tools

  • Preview; subject to change
  • Identity lookups do not accept UPNs
  • Put the entity type before the name (device zava-fin-01)
  • Invoke the graph meter, so they cost money