Sentinel MCP Natural-Language Hunting Digest

Overview

This flow turns recurring threat-hunting hypotheses into an automated daily readout. On a daily schedule it opens a session with the Microsoft Sentinel MCP (Preview) server, asks it a configurable set of natural-language hunting questions (unusual sign-ins, new admin/role grants, password-spray patterns, rare process executions), lets the MCP translate each one to KQL and run it against the workspace, collects the findings into an HTML digest, and delivers that digest to a Microsoft Teams channel and an email inbox.

Why it matters: Running the same hunts by hand every day is slow and inconsistent. Natural-language-to-KQL via the Sentinel MCP makes a repeatable daily hunt cheap to operate, and the digest gives analysts and leadership a single morning readout with a consistent question set.

Status: Built and verified (Flow Checker 0 errors / 0 warnings). Ships Off - going live requires only authorizing the three connections and setting the six environment-variable values.

Use Case

A SOC or IT-security team wants a recurring, low-effort threat-hunting digest grounded in their own Microsoft Sentinel data, without an analyst hand-writing and running KQL each morning. Audience: IT Admins (operational hunt results) and Executives (daily posture readout).

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpdataexploration
Microsoft Teams	shared_teams	PostMessageToConversation
Office 365 Outlook	shared_office365	SendEmailV2

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Tune the hunt set

Edit flowlibs_SentinelMcpHuntingQuestions (a JSON array) to add/remove natural-language hunts. No flow-logic change needed.

Change cadence

Edit the Recurrence trigger (frequency / hour / time zone).

Point at your workspace

Set flowlibs_SentinelWorkspaceId; set flowlibs_SentinelMcpToolName to the exact MCP tool exposed in your tenant.

Retarget delivery

Set the Teams group/channel ids and the recipient email; remove the Teams or email action if you only want one channel.

Threshold escalation

Add a Condition after the loop to escalate (high-importance email, @mention) when findings exceed a count.

Persist generated KQL

Extend the loop to store the MCP-returned KQL as Sentinel analytics rules or in a Dataverse log table.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@json(parameters('EnvVar_HuntingQuestions'))

@{coalesce(outputs('Initialize_Mcp_Session')?['headers']?['Mcp-Session-Id'], '')}

@{items('Apply_to_each_Hunting_Question')}

@{coalesce(string(body('Invoke_Sentinel_MCP_Hunting_Query')?['result']), 'No findings returned for this query.')}

@outputs('Compose_Digest_Html')

Customize & download