Sentinel MCP Entity Enrichment on Demand

Overview

This flow gives security analysts on-demand entity context without writing KQL. It is triggered by an HTTP request (from a Teams message-action, a Power Automate button, or any caller) carrying a single indicator - an IP, user, host, or file hash. The flow opens a Microsoft Sentinel MCP (Preview) session, calls the configured enrichment tool, which generates and runs the underlying KQL, and returns a concise enrichment card to the analyst's Teams channel. Every lookup is written to a Dataverse audit table for governance.

Why it matters: Ad-hoc indicator lookups interrupt investigations and not every analyst writes KQL. A one-click enrichment over Sentinel data keeps analysts in flow while logging every query and requester for audit.

Build status: Built and verified - Flow Checker 0 errors / 0 warnings. Ships in the Off state (demo). Going live requires only connection authorization and env-var configuration.

Use Case

An analyst is triaging an alert and wants quick, conversational enrichment of an indicator (e.g. "what do we know about 10.0.4.7 in the last 14 days?"). They invoke the flow from Teams (or a button), pass the indicator, and get a formatted context card back plus a governed audit trail - no KQL required.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpdataexploration
Microsoft Teams	shared_teams	PostMessageToConversation
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Watchlist add

Branch after enrichment to add high-risk entities to a Sentinel watchlist via the MCP knowledge-objects endpoint.

Threat-intel join

Combine the MCP findings with an external TI feed before composing the card.

Suggested containment

Have the MCP (or an LLM step) propose containment actions and surface them as adaptive-card buttons.

Entity-type routing

Switch the MCP tool/arguments by entityType (IP vs. user vs. hash) for richer, type-specific lookups.

RBAC + cost guard

Restrict who can enrich which entities and reject expensive/long-window scans.

Adaptive card reply

Swap the HTML card for a Teams adaptive card with structured fields.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{coalesce(triggerBody()?['entity'],'')}

@{coalesce(triggerBody()?['entityType'],'IP')}

{ "jsonrpc":"2.0", "id":"@{guid()}", "method":"initialize", "params":{ "protocolVersion":"...", "capabilities":{}, "clientInfo":{} } }

@{coalesce(outputs('Initialize_Mcp_Session')?['headers']?['Mcp-Session-Id'], '')}

{ "jsonrpc":"2.0", "id":"@{guid()}", "method":"tools/call", "params":{ "name":"@{variables('varMcpToolName')}", "arguments":{ "entity":"...", "entityType":"...", "lookbackDays":"..." } } }

@{coalesce(string(body('Enrich_Entity_Via_Mcp')?['result']),'No enrichment data was returned by the MCP tool.')}

Customize & download