Sentinel MCP Auto-Response Recommendation

Overview

This flow adds AI-recommended, human-approved incident response to Microsoft Sentinel. When a Sentinel incident is created, a Sentinel automation rule posts it to this flow. The flow asks the Sentinel MCP (Preview) to recommend containment actions (disable user, isolate host, block IP) from the incident context, posts the recommendations to the approver for one-click approval (surfaces in the Teams Approvals hub + email), and on approval runs the corresponding Sentinel playbook and writes an audit comment back to the incident.

Why it matters: Fully automated containment is risky; manual response is slow. MCP recommendations plus an approval gate balance speed and control, with a full audit trail tied together by a correlation id.

Status: Built and verified - Flow Checker 0 errors / 0 warnings (in-designer). Ships Off (demo). Going live requires only connection authorization, environment-variable configuration, and a Sentinel automation rule pointed at the flow URL.

Use Case

A SOC wants suggested containment for new Sentinel incidents with a human in the loop before any destructive action is taken, plus an auditable record of what was recommended, who approved/rejected, and which playbook ran.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpdataexploration
Approvals	shared_approvals	StartAndWaitForAnApproval

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Auto-approve low-risk

Branch on severity/action type to skip the approval for safe actions.

Tiered approval

Require stricter or multiple approvers for destructive actions (disable user / isolate host).

Multiple playbooks

Map recommended action types to different playbook ids (extend flowlibs_SentinelPlaybookResourceId to a JSON map + a Switch).

Rollback

Add undo playbooks for reversible containment.

Swap to the Sentinel connector

If shared_azuresentinel is provisioned, replace the Request trigger with the incident-created trigger and the ARM HTTP calls with connector actions.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{guid()}

@{coalesce(triggerBody()?['incidentArmId'], concat('/subscriptions/', parameters('EnvVar_SentinelSubscriptionId'), '/resourceGroups/', parameters('EnvVar_SentinelResourceGroup'), '/providers/Microsoft.OperationalInsights/workspaces/', parameters('EnvVar_SentinelWorkspaceName'), '/providers/Microsoft.SecurityInsights/incidents/', coalesce(triggerBody()?['incidentName'], string(triggerBody()?['incidentNumber']))))}

@{coalesce(outputs('Open_MCP_Session')?['headers']?['Mcp-Session-Id'],'')}

@coalesce(string(body('Get_Containment_Recommendations')?['result']), 'No containment recommendations were returned by Sentinel MCP.')

@outputs('Start_Containment_Approval')?['body/outcome']

@{concat(parameters('EnvVar_ArmBaseUrl'),'/')}

Customize & download