Question

You are a SOC analyst using a Jupyter notebook connected to the Microsoft Sentinel MCP Server. During an investigation of a suspected compromised service account, you want to programmatically discover which devices, IP addresses, and other accounts share a relationship with the suspicious account so you can visualize the blast radius of the potential breach. Which capability should you use to retrieve these connected entities and their relationships?

Accepted Answer

Run a Sentinel Graph query through the MCP Server to traverse entity relationships and return connected entities for the account

Answer

Configure a summary rule to aggregate the account's activity into a custom table for daily reporting

Answer

Create a scheduled analytics rule with entity mapping so the account is enriched on new incidents

Answer

Submit a KQL job in the Sentinel data lake to reprocess archived logs for the account