Sentinel MCP Incident Triage to Teams

Overview

This flow speeds SOC first-response triage. On a schedule it detects newly created Microsoft Sentinel incidents, uses the Sentinel MCP (Preview) connector to pull enriched triage context (entities, related alerts, KQL summaries), posts a triage Adaptive Card to the SOC Microsoft Teams channel, and writes the triage summary back to the incident as a comment.

Why it matters: Analysts spend minutes gathering context per incident. MCP-driven enrichment delivers a ready-made triage view in Teams instantly, and the write-back leaves an auditable triage note on the incident itself.

Build note - architecture adapted from the original draft. The original idea called for the standard Microsoft Sentinel connector (shared_azuresentinel) trigger When an incident is created + the UpdateIncident action. That connector is not provisioned in this environment (only shared_sentinelmcp and a Lansweeper add-on exist). The flow was therefore built connector-first where connectors exist (Sentinel MCP + Teams) and uses the Azure Resource Manager REST API for Microsoft Sentinel (Microsoft.SecurityInsights/incidents) via the built-in HTTP action - in place of the missing connector. A Recurrence poll substitutes the unavailable Sentinel event trigger.

Use Case

A SOC wants every newly created Sentinel incident to arrive in Teams pre-enriched for fast triage, with the triage context recorded back on the incident so the work is auditable and not duplicated.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpdataexploration
Microsoft Teams	shared_teams	PostCardToConversation

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Poll frequency / lookback

Change the Recurrence interval and flowlibs_IncidentLookbackMinutes together so the window matches the cadence.

Severity routing

Branch on properties/severity to post High/Critical incidents to a different channel.

Auto-assign / status

Extend the ARM write-back to PUT the incident with an owner or status (requires the incident etag + full body).

Suppression

Add a Filter array before the loop to skip known-benign titles/rules.

Richer enrichment

Adjust the MCP arguments and the configured tool to pull related alerts / hunting results.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{items('For_Each_Incident')?['name']}

@{concat(parameters('EnvVar_ArmBaseUrl'),'/subscriptions/',parameters('EnvVar_AzureSubscriptionId'),'/resourceGroups/',parameters('EnvVar_SentinelResourceGroup'),'/providers/Microsoft.OperationalInsights/workspaces/',parameters('EnvVar_SentinelWorkspaceName'),'/providers/Microsoft.SecurityInsights')}

@{addMinutes(utcNow(), mul(-1, int(parameters('EnvVar_IncidentLookbackMinutes'))))}

@{coalesce(outputs('Open_Sentinel_MCP_Session')?['headers']?['Mcp-Session-Id'],'')}

@{coalesce(string(body('Enrich_Incident_With_MCP')?['result']),'No MCP enrichment was returned for this incident.')}

@not(contains(string(body('Get_Incident_Comments')), variables('varTriageMarker')))

@{concat(parameters('EnvVar_ArmBaseUrl'),'/')}

Customize & download