Sentinel MCP Daily Security Posture Report

Overview

This flow automates daily SOC posture reporting from Microsoft Sentinel using the Sentinel MCP (Preview) connector. Each morning at 07:00 it opens an MCP session, asks the Sentinel MCP server for a security posture rollup (open incidents by severity, mean time to acknowledge, top MITRE tactics, noisy analytics rules), writes the metrics as a new row in a Dataverse trend table, refreshes the Power BI dashboard dataset, and emails leadership a formatted summary.

Why it matters: Posture reporting is normally manual and inconsistent. An MCP-driven rollup gives leadership a reliable, repeatable daily security picture and a Dataverse-backed trend history that powers a Power BI dashboard.

Flow ID: CF-707 - Status: Built (ships Off) - Solution: FlowLibs - Sentinel MCP Daily Security Posture Report

Use Case

Security leadership (CISO, IT admins) wants a consistent daily posture report and a trend dashboard without an analyst manually pulling numbers from Sentinel each morning. This flow delivers a scheduled rollup, a durable metric history in Dataverse, an auto-refreshed Power BI dashboard, and a summary email - all from a single scheduled flow.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpdataexploration
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Power BI	shared_powerbi	RefreshDataset
Office 365 Outlook	shared_office365	SendEmailV2

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

SLA tracking

Add MTTR/MTTA target columns and a Condition to flag breaches before the email.

Noisy-rule tuning

Extend the posture question to list specific rules to review, and break them onto their own dashboard tile.

Per-team breakdown

Parameterize the MCP question by analyst group and store a team column.

Cadence

Change the Daily_0700 recurrence (e.g. twice daily, or weekday-only via a weekDays schedule).

Severity thresholds

Add an Initialize Variable for a high-severity alert threshold and escalate via Teams when exceeded.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{guid()}

@{coalesce(outputs('Initialize_Mcp_Session')?['headers']?['Mcp-Session-Id'], '')}

{ "jsonrpc":"2.0", "id":"@{guid()}", "method":"initialize", "params":{ "protocolVersion":"...", "capabilities":{}, "clientInfo":{} } }

{ "jsonrpc":"2.0", "id":"@{guid()}", "method":"tools/call", "params":{ "name":"@{variables('varMcpToolName')}", "arguments":{ "question":"...", "workspaceId":"..." } } }

@{concat('Security Posture ', formatDateTime(utcNow(),'yyyy-MM-dd'))}

@coalesce(body('Invoke_Mcp_Posture_Rollup')?['result']?['openIncidents'], 0)

Customize & download