You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/datalake/sentinel-mcp-triage-tool.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@ To access the triage tool collection, you must have the following prerequisites:
32
32
33
33
## Add the triage collection
34
34
35
-
To add the data exploration collection, you must first set up add Microsoft Sentinel's unified MCP server interface. Follow the step-by-step instructions for compatible [AI-powered code editors and agent-building platforms](sentinel-mcp-get-started.md#add-microsoft-sentinels-collection-of-mcp-tools).
35
+
To add the data exploration collection, you must first set up add Microsoft Sentinel's unified MCP server interface. Follow the step-by-step instructions for compatible AI-powered code editors and agent-building platforms listed in the **Prerequisites** section.
36
36
37
37
The triage collection is hosted at the following URL:
This tool lists security incidents and filters them by date range, severity, status, assigned analyst, and investigation state. It can paginate up to 10,000 incidents per page.
47
+
This tool lists security incidents and filters them by date range, severity, status, assigned analyst, and investigation state.
48
48
49
49
| Parameters | Required? | Description |
50
50
|---|---|---|
@@ -72,7 +72,7 @@ This tool retrieves a security incident by ID, including its properties, correla
72
72
73
73
### List security alerts related to an incident (`ListAlerts`)
74
74
75
-
This tool lists security alerts, sorts them, and filters them by date range, severity, and status. It can paginate up to 10,000 alerts per call.
75
+
This tool lists security alerts, sorts them, and filters them by date range, severity, and status.
76
76
77
77
| Parameters | Required? | Description |
78
78
|---|---|---|
@@ -83,7 +83,7 @@ This tool lists security alerts, sorts them, and filters them by date range, sev
83
83
|`skip`|No | Skips a specified number of items from the start of the result set|
84
84
|`top`|No | Limits the number of items returned in the response|
85
85
86
-
### Get a security incident (`GetAlertByID`)
86
+
### Get a security alert (`GetAlertByID`)
87
87
88
88
This tool retrieves a security alert by ID. It returns the complete alert details, including severity, status, classification, and related evidence entities.
0 commit comments