Notebooks, MCP and Sentinel Graph

What it is

Some hunts need more than KQL. Jupyter notebooks let you analyse the data lake with Python, machine learning and visualisation. The Microsoft Sentinel MCP server lets AI tools query security data in plain language. Sentinel graph models the relationships between users, devices, resources and threats so you can reason about reach and impact. These are the tools for deep analysis, large scale data and AI assisted hunting.

How it works

Jupyter notebooks on the data lake

Jupyter notebooks are interactive documents that mix code, results and notes. For Sentinel they are provided by the Microsoft Sentinel extension for Visual Studio Code, which connects to the data lake and lets you run Python for Spark (PySpark) and use Python libraries.

What notebooks add over KQL:

• Complex transformations and statistics, across very large datasets, using distributed computing with Apache Spark.
• Machine learning, for example to build an anomaly detection model or to cluster behaviour.
• Visualisation, with charts and graphs inside the notebook.
• Low and slow attacks, which evade rule based detection, can be found by analysing long histories and connected events.
• Reproducibility, because the notebook documents the steps of the hunt.

A good pattern is to use KQL for exploration and filtering, and a notebook when you need modelling, joining many sources, or algorithms KQL does not offer. Notebooks can run as scheduled notebook jobs so an analysis repeats on a schedule, with results written back to a table.

The Sentinel MCP server

The Model Context Protocol (MCP) is an open standard that lets AI models use external tools and data in a structured and safe way. Microsoft Sentinel's MCP server is a hosted interface that exposes security tools to AI clients, so analysts can query security data in natural language and build security agents, without writing KQL or knowing the table schema.

Key points:

• It is fully hosted and uses Microsoft Entra for identity, so there is no infrastructure to deploy.
• Tools are grouped into scenario focused collections.

• Typical tools include search tables (semantic search over the table catalog, returning schemas), a query tool for the lake, an entity analyzer that gives risk verdicts for users and URLs, and a tool to list data lake workspaces.
• Compatible clients include Microsoft Security Copilot, Microsoft Copilot Studio, Microsoft Foundry and Visual Studio Code. A hunter can connect an AI assistant in Visual Studio Code, where the notebooks also run, to the MCP server and ask questions in plain language.
• Most tools need you to be onboarded to the Sentinel data lake.
• Access needs at least a role such as Security Reader, Security Operator or Security Administrator, for users, managed identities or service principals.

Example prompts are "Find the top three users at risk and explain why", or "Find sign in failures in the last 24 hours and summarise the key findings". As with any AI, check the results against the underlying data before acting.

Sentinel graph

Microsoft Sentinel graph is a graph analytics capability that models nodes, such as users, devices, cloud resources and threat intelligence, and edges, which are the relationships and activity between them. It lets defenders and AI agents reason over connected data in a way tables cannot, for example "what could happen if this account is compromised?" or "what is the blast radius of this compromised document?".

Graph powers several experiences across the platform.

Use Sentinel graph to analyse relationships between entities. For example, to answer whether a set of compromised accounts shares access to a server, graph shows the connections directly, where a KQL join would be laborious.

Putting the tools together

A typical advanced hunt moves between tools: a hunter explores with KQL, uses the MCP server to ask a plain language question and find the right tables, switches to a notebook to model a year of history, and uses graph to see which privileged paths the suspects have. Findings are then turned into analytics rules or custom detections.

A worked scenario

A SOC suspects a low and slow credential attack that stays under every threshold. A hunter uses the Sentinel MCP server from Visual Studio Code to ask which tables hold sign in data, and the search tables tool returns the schemas. In a notebook on the data lake, she uses PySpark to compute a baseline of sign in behaviour over twelve months and flags accounts that deviate slightly but persistently. For the flagged accounts, graph based hunting shows two of them can reach a domain controller through a service account. The team creates an analytics rule from the finding, and the notebook runs weekly as a job.