Sentinel MCP Analyst Q&A Bot

Overview

A Teams-triggered conversational bot that gives security analysts governed, plain-language access to Microsoft Sentinel. An analyst posts a natural-language question in a designated Teams channel (e.g. "show failed logins for user X this week"). The flow routes the question to the Microsoft Sentinel MCP (Preview) connector, which generates and runs KQL against the workspace, then posts the formatted answer back into Teams and writes a governed audit row to Dataverse.

Why it matters: Not every analyst writes KQL. This bridges the gap conversationally while logging every question, the generated query, and the requester for governance and audit.

Build status: Built via API-first deployment. Flow Checker 0 errors / 0 warnings. Ships Off (demo); going live requires only authorizing the three connections and setting the four environment-variable values.

Use Case

Security/SOC analysts want to interrogate Sentinel in natural language from within Teams, without writing KQL and without leaving their collaboration tool - while the security team retains a complete, governed record of who asked what and which query ran.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpdataexploration
Microsoft Teams	shared_teams	OnNewChannelMessage PostMessageToConversation
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Channel scope

Point flowlibs_TeamsGroupId / flowlibs_TeamsChannelId at the SOC channel you want monitored. Trigger polls every 5 minutes (adjust the recurrence for lower latency).

MCP tool

Change flowlibs_SentinelMcpToolName to match the data-exploration / hunting tool exposed by your tenant's Sentinel MCP preview.

Saved questions / RBAC

Add a Condition before Ask Sentinel Mcp to allow only approved askers, or to map quick-pick prompts.

Threaded replies

Swap PostMessageToConversation for a reply op if you want answers threaded under the question using the captured varSourceMessageId.

Richer audit

Extend the flowlibs_sentinelqalog table (e.g. result row count, latency) and populate more item/ fields in Log Question And Answer.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{trim(replace(replace(replace(replace(coalesce(triggerOutputs()?['body/body/content'],''),'<p>',''),'</p>',' '),'<br>',' '),'&nbsp;',' '))}

@{coalesce(triggerOutputs()?['body/from/user/displayName'],'Unknown analyst')}

@{coalesce(outputs('Open_Mcp_Session')?['headers']?['Mcp-Session-Id'], '')}

{ "jsonrpc":"2.0", "id":"@{guid()}", "method":"tools/call", "params":{ "name":"@{variables('varMcpToolName')}", "arguments":{ "question":"@{variables('varQuestion')}", "workspaceId":"@{variables('varWorkspaceId')}" } } }

@{coalesce(string(body('Ask_Sentinel_Mcp')?['result']), 'No results were returned by the Sentinel MCP for this question.')}

@{coalesce(outputs('Post_Answer_To_Teams')?['body/id'],'')}

Customize & download