Sentinel MCP Watchlist Builder from Threat Intel

Overview

This flow keeps a Microsoft Sentinel watchlist current from external threat intelligence. On a 3-hour schedule it pulls IOC indicators from a threat-intel feed (HTTP), asks the Sentinel MCP (Preview) to validate and de-duplicate them against existing watchlist data, upserts the new IOCs into the target Sentinel watchlist via the Azure Resource Manager REST API, and reports the additions to a SOC Teams channel.

Why it matters: Manually maintaining watchlists is slow and error-prone. MCP-assisted validation keeps them clean, current, and timely, and the whole pipeline is traceable end-to-end via a correlation ID.

Status: Built and shipped Off (demo). Going live requires only connection authorization and environment-variable configuration - no logic changes.

Use Case

A SOC enriches its detections with Sentinel watchlists and wants those watchlists fed automatically from external intel rather than maintained by hand. This flow ingests indicators on a schedule, uses the Sentinel MCP to keep the list clean (validated, de-duplicated, high-confidence), and notifies the team of what changed.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpknowledgeobjects
Microsoft Teams	shared_teams	PostMessageToConversation

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Expiry

Age out stale indicators (add a scheduled prune of old watchlist items, or set TTL metadata on each item).

Confidence filter

Instruct the MCP tool (or a Filter array) to keep only high-confidence IOCs before writing.

Multi-feed

Initialize several feed URLs and merge their results before the MCP validate step.

Feed shape

Adjust Fetch_Indicators headers/auth and Compose_New_Indicators extraction to match your feed's JSON schema and the MCP tool's result shape.

Watchlist key

Set the watchlist item's itemsKeyValue mapping to your watchlist's column schema.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{guid()}

@{concat('Bearer ', variables('varTiApiKey'))}

@{coalesce(outputs('Init_MCP_Session')?['headers']?['Mcp-Session-Id'],'')}

@coalesce(body('MCP_Validate_Indicators')?['result']?['indicators'], body('Fetch_Indicators'), createArray())

@length(outputs('Compose_New_Indicators'))

@{concat(variables('varArmBase'), '/subscriptions/', variables('varSubscriptionId'), '/resourceGroups/', variables('varResourceGroup'), '/providers/Microsoft.OperationalInsights/workspaces/', variables('varWorkspaceName'), '/providers/Microsoft.SecurityInsights/watchlists/', variables('varWatchlistAlias'), '/watchlistItems/', guid(), '?api-version=2023-02-01')}

@{concat(variables('varArmBase'), '/')}

Customize & download