Connect your own Microsoft Sentinel workspace (Azure AD App Registration) to manage Incidents, Bookmarks, Watchlists, Analytics Rules, and run KQL hunting queries against your Log Analytics workspace.
What this app can do
23 tools registered
Connect SentinelFree
Connect your own Microsoft Sentinel workspace by saving an Azure AD App Registration's tenant/client id + client secret plus the workspace's subscription id, resource group, and workspace name, after checking both OAuth2 audiences (ARM + Log Analytics Query) actually work. Create the App Registration in Azure AD > App registrations, grant it Microsoft Sentinel Contributor (or Reader) + Log Analytics Reader on the resource group.
List ConnectionsFree
List the connected Microsoft Sentinel workspaces.
Disconnect SentinelFree
Disconnect a Microsoft Sentinel workspace: deletes the saved App Registration credentials. Nothing in Sentinel/Azure itself is changed.
List Incidents8 tok
List Sentinel incidents in the connected workspace, optionally filtered by status.
Get Incident8 tok
Read one Sentinel incident in full by its name (GUID).
Update Incident16 tok
Update a Sentinel incident's status, severity, owner, classification, and/or labels. Closing an incident requires classification and classification_reason.
Add Incident Comment16 tok
Add a comment to a Sentinel incident, for handoff notes and triage context.
List Incident Comments8 tok
List the comments on a Sentinel incident.
List Analytics Rules8 tok
List analytics (alert) rules configured on the connected Sentinel workspace.
Set Analytics Rule Enabled16 tok
Enable or disable an analytics rule without deleting it.
List Automation Rules8 tok
List automation rules (SOAR playbook triggers) configured on the connected Sentinel workspace.
Set Automation Rule Enabled16 tok
Enable or disable an automation rule without deleting it.
List Watchlists8 tok
List watchlists (e.g. blocked IPs, VIP users) configured on the connected Sentinel workspace.
Create Watchlist16 tok
Create a new watchlist (e.g. a list of known-bad IPs) on the connected Sentinel workspace.
List Watchlist Items8 tok
List the rows/items inside a watchlist.
Add Watchlist Item16 tok
Add a row/item to a watchlist.
List Threat Indicators8 tok
List threat intelligence indicators (IOCs) on the connected Sentinel workspace.
Create Threat Indicator16 tok
Push a new threat intelligence indicator (IOC) -- e.g. a malicious IP, domain, or file hash -- into Sentinel.
List Bookmarks8 tok
List saved hunting bookmarks on the connected Sentinel workspace.
Create Bookmark16 tok
Save a KQL query as a hunting bookmark for later reference.
List Data Connectors8 tok
List data connectors (log source integrations) configured on the connected Sentinel workspace.
Run Kql Query20 tok
Run a KQL (Kusto Query Language) query against the connected Sentinel workspace's Log Analytics data -- e.g. 'SecurityAlert | take 20'. Read-only investigation.
Audit Sentinel Workspace40 tok
Build one aggregated health report across the connected Sentinel workspace: open incidents, unassigned High/Medium incidents older than a threshold, and disabled high-severity analytics rules.