Connect Microsoft Sentinel to ChatGPT: Manage Incidents & Alerts

If you want to connect Microsoft Sentinel to ChatGPT so your AI agents can triage incidents, hunt for threats, execute SOC playbooks, and update watchlists, you need a Model Context Protocol (MCP) server. If your team uses Claude, check out our guide on connecting Microsoft Sentinel to Claude or explore our broader architectural overview on connecting Microsoft Sentinel to AI Agents.

Giving a Large Language Model (LLM) read and write access to an enterprise Security Information and Event Management (SIEM) platform is a massive engineering challenge. You either spend weeks building, hosting, and maintaining a custom MCP server to translate LLM JSON arguments into Azure's highly specific Resource Manager payloads, or you use a managed infrastructure layer.

This guide breaks down exactly how to use Truto to generate a secure, authenticated MCP server for Microsoft Sentinel, connect it natively to ChatGPT, and execute complex security operations using natural language.

The Engineering Reality of the Microsoft Sentinel API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, implementing it against Microsoft Sentinel's API is exceptionally painful for three distinct reasons.

The Azure Resource Manager (ARM) Topology

Unlike standard B2B SaaS applications that use simple REST paths (e.g., /api/v1/incidents), Microsoft Sentinel operates entirely within the Azure Resource Manager (ARM) framework. Every single API call requires a rigid hierarchy of path parameters: subscriptionId, resourceGroupName, and workspaceName.

An LLM operating in isolation does not know your Azure topology. If you build a naive MCP server, ChatGPT will hallucinate subscription UUIDs or fail to structure the URI correctly. A production-grade MCP architecture must abstract this routing layer, storing the deployment topology at the connection level so the LLM only needs to provide the actual incident ID or query parameters.

Polymorphic Security Entities

Sentinel incidents are composed of diverse "entities" - IP addresses, hostnames, file hashes, user accounts, and Azure resources. The Microsoft Sentinel API returns these entities as polymorphic JSON objects. A kind field dictates the schema of the properties object.

When exposing this to ChatGPT, if your MCP schema is too loose, the LLM will fail to understand the relationship between a malicious IP and an infected host. Your MCP server must dynamically translate the polymorphic API definitions into strict JSON-RPC schemas that the model can parse and reason about reliably.

Asynchronous 202 Accepted Workflows

Many destructive or heavy operations in Sentinel (like deleting a large watchlist or bulk-updating threat indicators) do not complete immediately. The API returns an HTTP 202 Accepted with an Azure-AsyncOperation header containing a polling URL.

Because LLMs operate in synchronous chat sessions, blocking the response while a background task runs will result in timeouts. Your integration layer must expose these asynchronous states cleanly so the agent can inform the analyst that the job has been queued, rather than crashing the tool call.

How to Generate a Microsoft Sentinel MCP Server

Truto eliminates the need to build and host custom integration infrastructure. By pointing Truto at a connected Microsoft Sentinel workspace, you can dynamically generate a secure MCP server endpoint that handles OAuth refreshes, ARM routing, and schema translation automatically.

You can provision this server via the Truto dashboard or programmatically via the API.

Method 1: Via the Truto UI

1. Navigate to the Integrated Accounts page in your Truto dashboard.
2. Select your connected Microsoft Sentinel account.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration (e.g., name, method filters like read or write, and tag filters).
6. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the Truto API

For platform engineers building AI agent fleets, you can generate MCP servers programmatically. This allows you to spin up heavily scoped tools for specific SOC analysts on demand.

Make a POST request to /integrated-account/:id/mcp:

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Sentinel SOC Assistant",
    "config": {
      "methods": ["read", "write"],
      "tags": ["incidents", "indicators", "playbooks"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The API responds with the server metadata and the critical url field. Treat this URL as a secure credential - it contains the hashed routing token necessary to authenticate the JSON-RPC traffic.

{
  "id": "mcp_8f7d6c5b",
  "name": "Sentinel SOC Assistant",
  "config": {
    "methods": ["read", "write"],
    "tags": ["incidents", "indicators", "playbooks"]
  },
  "url": "https://api.truto.one/mcp/abcd1234efgh5678"
}

Connecting the MCP Server to ChatGPT

Once you have the generated URL, connecting it to ChatGPT takes less than a minute. You can do this through the ChatGPT interface or via a manual SSE configuration file if you are running custom infrastructure.

Method A: Via the ChatGPT UI

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Ensure Developer mode is enabled.
3. Under MCP servers / Custom connectors, click Add a new server.
4. Provide a descriptive name like "Microsoft Sentinel - Production".
5. Paste the Truto MCP URL into the Server URL field and save.

ChatGPT will immediately execute an initialize handshake, request the tools/list schema, and map the Sentinel capabilities into its context window.

Method B: Via Manual SSE Config

If you are running a local inspector or building a custom agent framework that consumes MCP, you can route traffic to the Truto server using the standard SSE transport.

Create a config file (e.g., mcp_config.json):

{
  "mcpServers": {
    "microsoft_sentinel": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/abcd1234efgh5678"
      ]
    }
  }
}

Your client will now route JSON-RPC 2.0 calls directly to Truto's edge network, which handles the complex translation into the Microsoft Sentinel API.

Hero Tools for Microsoft Sentinel

Truto automatically derives MCP tools from Microsoft Sentinel's API documentation. Here are the highest-leverage tools for SOC automation.

List All Incidents

list_all_microsoft_sentinel_incidents

Fetches a paginated list of all active incidents in the specified workspace. This is the starting point for almost every automated triage workflow, allowing the LLM to identify high-severity items that need immediate attention.

"Fetch all new, high-severity incidents in the primary workspace from the last 4 hours."

Get Incident Alerts

list_all_microsoft_sentinel_incident_alerts

Retrieves the specific underlying alerts that triggered an incident. This is critical for context gathering, as it provides the raw security signals, impacted entities, and detection logic used by the SIEM.

"Get the detailed alerts for incident ID 'inc-49281' and list the compromised IP addresses."

Update Incident Task

update_a_microsoft_sentinel_incident_task_by_id

Allows the AI agent to update the status of an incident task. As the LLM completes investigation steps (like checking IP reputation), it can systematically check off required SOC procedures in Sentinel to maintain audit trails.

"Mark the 'Verify external IP reputation' task as completed for incident ID 'inc-49281' with a note that VirusTotal returned clean results."

Run Automation Playbook

create_a_microsoft_sentinel_incident_run_playbook

Triggers an Azure Logic App playbook against a specific incident. This bridges the gap between natural language reasoning and hard-coded infrastructure automation, allowing the LLM to execute pre-approved containment actions.

"Run the 'Block-EntraID-User' playbook on incident 'inc-49281' to contain the compromised identity."

Create Threat Indicator

create_a_microsoft_sentinel_main_indicator

Injects a new threat intelligence indicator (like a malicious IP, domain, or file hash) directly into the workspace. This is incredibly powerful for continuous feedback loops where the AI discovers a novel IOC during investigation and proactively blocks it.

"Create a new threat indicator for the IP address '198.51.100.42' with high confidence and tag it as part of the APT-29 campaign."

Update Watchlist

update_a_microsoft_sentinel_watchlist_by_id

Creates or updates a watchlist. Watchlists are used in Sentinel query logic to correlate events against known high-risk assets or VIP users. The LLM can dynamically update these lists based on recent behavioral anomalies.

"Update the 'VIP-Executives' watchlist to include the newly provisioned CFO account alias."

For the complete inventory of available operations - including bookmarks, data connectors, and analytics settings - check out the Microsoft Sentinel integration page.

Workflows in Action

Connecting tools is only useful if the agent can orchestrate them effectively. Here is exactly how ChatGPT uses these Truto-generated tools to automate real SOC processes.

Workflow 1: Triage and Remediate a High-Severity Incident

When a surge of alerts hits the SOC, human analysts struggle to correlate data quickly. You can ask ChatGPT to handle the initial triage and containment.

"Review the newest high-severity incident in the workspace. Extract the alerts, check the required tasks, and if it involves a compromised identity, run the containment playbook and update the task status."

1. ChatGPT calls list_all_microsoft_sentinel_incidents filtering for severity=High to locate the target incident.
2. It calls list_all_microsoft_sentinel_incident_alerts to read the specific detection signals.
3. Recognizing an identity threat, it calls create_a_microsoft_sentinel_incident_run_playbook, passing the Logic App resource ID to disable the user.
4. Finally, it calls update_a_microsoft_sentinel_incident_task_by_id to mark the "Containment" step as complete in the Sentinel UI.

sequenceDiagram
    participant User as User
    participant GPT as ChatGPT
    participant Truto as Truto MCP
    participant Sentinel as "Upstream API (Microsoft Sentinel)"

    User->>GPT: "Review and contain the newest high-severity incident"
    GPT->>Truto: list_all_microsoft_sentinel_incidents()
    Truto->>Sentinel: GET /incidents?severity=High
    Sentinel-->>Truto: Return Incident ID 9482
    Truto-->>GPT: JSON incident data
    
    GPT->>Truto: list_all_microsoft_sentinel_incident_alerts(incident_id=9482)
    Truto->>Sentinel: GET /incidents/9482/alerts
    Sentinel-->>Truto: Return compromised identity alerts
    Truto-->>GPT: JSON alert data
    
    GPT->>Truto: create_a_microsoft_sentinel_incident_run_playbook(...)
    Truto->>Sentinel: POST /incidents/9482/runPlaybook
    Sentinel-->>Truto: 204 No Content
    Truto-->>GPT: Success

Workflow 2: Threat Intelligence Extraction

Analysts often receive raw text blobs from external security feeds or emails. ChatGPT can parse this unstructured data and push the structured indicators straight into Sentinel.

"Analyze this threat report text. Extract any malicious IP addresses and domains, and create new threat indicators for them in Sentinel with a tag for 'Q3-Phishing-Campaign'."

1. ChatGPT uses its internal LLM capabilities to parse the unstructured text, extracting the IPs and domains.
2. For each extracted IOC, it formats a payload and calls create_a_microsoft_sentinel_main_indicator.
3. It verifies the response, ensuring the items were ingested correctly.
4. It returns a summary to the user detailing exactly what was added to the SIEM.

Handling Rate Limits

Microsoft Sentinel, running on top of Log Analytics, enforces strict API rate limits to prevent aggressive polling and bad queries from degrading workspace performance.

It is vital to understand that Truto does not retry, throttle, or apply backoff on rate limit errors. If you blast the MCP server with 50 concurrent tool calls and the upstream API returns an HTTP 429, Truto passes that 429 directly back to ChatGPT.

However, Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) conforming to the IETF specification. This guarantees that your agent framework or the ChatGPT client receives predictable, standard signals and can implement its own backoff logic reliably.

Security and Access Control

Giving an AI agent access to a production SIEM requires stringent security guardrails. Truto's MCP architecture provides multiple layers of access control out of the box:

• Method Filtering: You can configure an MCP server to strictly allow read operations. This ensures that even if the LLM hallucinates or is maliciously prompted, it physically cannot execute a write method like deleting rules or triggering playbooks.
• Tag Filtering: Restrict the agent to specific domains. By passing tags: ["incidents"], you prevent the LLM from accessing watchlists, settings, or connectors entirely.
• Time-To-Live (expires_at): Create ephemeral MCP servers for contractor access or temporary investigations. Truto automatically schedules a cleanup alarm and permanently deletes the routing token from edge storage once the time expires.
• Secondary Auth (require_api_token_auth): For highly sensitive SOC environments, the MCP URL alone isn't enough. By enabling this flag, the client must also supply a valid Truto API token in the headers, adding a robust secondary layer of authentication.

Final Thoughts

Integrating Microsoft Sentinel with ChatGPT transforms how your SOC operates. Instead of navigating through dozens of Azure portal blades to correlate alerts and run playbooks, analysts can orchestrate incident response entirely through natural language.

By utilizing Truto to generate the MCP infrastructure, you bypass the complexity of ARM routing, asynchronous polling constraints, and OAuth token management. Your engineering team avoids writing and maintaining custom TypeScript wrappers, and your security team gets immediate, secure, and fully governed AI agent integration.