Question

You are a SOC analyst using a Jupyter notebook to hunt across your Microsoft Sentinel workspace. You have installed the required SDK and want the notebook's AI agent to autonomously discover which Sentinel hunting capabilities are available and invoke them using natural-language prompts, rather than hand-coding each KQL request against a fixed REST endpoint. Which approach lets the notebook's language model dynamically enumerate and call the exposed Sentinel hunting tools?

Accepted Answer

Connect the notebook to the Sentinel MCP (Model Context Protocol) Server, which exposes Sentinel hunting tools that the LLM agent can discover and invoke through the protocol.

Answer

Import the Log Analytics Query API client and hard-code each KQL statement as a function the agent selects from.

Answer

Enable UEBA in the workspace so the notebook can read entity behavior tables directly via the Azure Monitor SDK.

Answer

Create a Sentinel summary rule that materializes hunting results into a custom table the notebook polls on a schedule.