Sentinel MCP New Detection-Rule Drafting

Overview

This flow turns analyst detection ideas into reviewed Microsoft Sentinel analytics rules. When an analyst submits a detection idea via Microsoft Forms, the flow asks the Sentinel MCP (Preview) to draft an analytics rule (KQL, entity mappings, severity), validates the draft, opens an Azure DevOps work item (change record) and routes it through an Approval, and on approval deploys the rule to Sentinel via ARM.

Status: Built - FlowLibs CF-711. Ships Off (demo). Going live requires only connection authorization + environment-variable configuration.

Why it matters: Writing and reviewing detection rules is slow. MCP-assisted drafting plus a governed review/deploy path accelerates detection coverage safely - every rule is human-reviewed before it goes live.

Use Case

A detection-engineering / SOC team wants a fast, governed path from idea to deployed rule. An analyst describes a detection idea; the Sentinel MCP drafts the rule; an engineer reviews it in Azure DevOps and approves; the rule is deployed to Sentinel. Advisory drafting + mandatory human review keeps quality high.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Microsoft Forms	shared_microsoftforms	CreateFormWebhook GetFormResponseById
MMicrosoft Sentinel MCP (Preview)	shared_sentinelmcp	invokemcpknowledgeobjects
Azure DevOps	shared_visualstudioteamservices	HttpRequest
Approvals	shared_approvals	StartAndWaitForAnApproval
Office 365 Outlook

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

MCP tool & arguments

Set flowlibs_SentinelMcpDraftToolName to your tenant's actual rule-drafting tool; extend arguments in MCP Draft Rule with data source / MITRE context.

Parse the draft

Initialize Drafted Rule stores the raw MCP result. In production, parse the JSON to pull query, severity, entityMappings into the Deploy Sentinel Rule body rather than passing the whole text as the query.

Review target

Swap the ADO HttpRequest create-work-item for CreatePullRequest if you want a true detection-as-code PR.

Rule schedule

Tune queryFrequency / queryPeriod / triggerThreshold in Deploy Sentinel Rule.

MITRE tagging & rollback

Auto-map tactics/techniques; add a disable-on-false-positive-spike companion flow.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{guid()}

@triggerOutputs()?['body/resourceData/responseId']

@{coalesce(outputs('Open_MCP_Session')?['headers']?['Mcp-Session-Id'], '')}

@{coalesce(string(body('MCP_Draft_Rule')?['result']), '')}

@greater(length(variables('varDraftedRule')), 0)

@{concat(parameters('EnvVar_AdoProject'), '/_apis/wit/workitems/$Task?api-version=7.0')}

@equals(body('Start_Rule_Review_Approval')?['outcome'], 'Approve')

@{concat(parameters('EnvVar_ArmBaseUrl'), parameters('EnvVar_SentinelResourceId'), '/providers/Microsoft.SecurityInsights/alertRules/', guid(), '?api-version=2023-02-01')}

@{concat(parameters('EnvVar_ArmBaseUrl'), '/')}

Customize & download