Microsoft Sentinel Skill

Agent Summary

Use this skill for Microsoft Sentinel management-plane tasks that run through the Microsoft.SecurityInsights ARM provider. You must supply an ARM-capable auth context, usually created by ./skills/azure/Connect-AzureApi.ps1.

When to Use

• List or retrieve Sentinel incidents from a workspace.
• Enumerate analytic alert rules through ARM.
• Call workspace-scoped Sentinel management endpoints when no higher-level wrapper exists.

Required Parameters

Get-SentinelIncident.ps1

Get-SentinelAlertRule.ps1

Invoke-SentinelArmRequest.ps1

Example Agent Prompts

• "Query all Sentinel incidents from the last 24 hours."
• "List all analytic alert rules for this Sentinel workspace."
• "Call the Sentinel ARM incidents endpoint directly and return every page."

Example Agent Workflow

$ctx = ./skills/azure/Connect-AzureApi.ps1 -AuthenticationType ManagedIdentity -Environment AzureCloud -SubscriptionId $subscriptionId

$incidents = ./skills/sentinel/Get-SentinelIncident.ps1 -SubscriptionId $subscriptionId -ResourceGroupName $resourceGroupName -WorkspaceName $workspaceName -AuthContext $ctx -Status Active

Security Caveats

• Use an ARM context with the least privilege required, such as Microsoft Sentinel Reader for read-only workflows.
• Do not confuse Sentinel management-plane access with Log Analytics data-plane access; KQL belongs to the loganalytics skill.
• Avoid client secret auth in production when managed identity or federated credentials are available.

Overview

This skill set runs Microsoft Sentinel operations on the management plane via ARM (Microsoft.SecurityInsights resources). It wraps authentication and request execution so you can manage incidents, alert rules, watchlists, automation rules, and data connectors consistently.

For Log Analytics data-plane operations such as KQL queries, custom table creation, workspace provisioning, and log ingestion, see the loganalytics skill.

Authentication

• Management plane: ARM token (https://management.azure.com/)
• The Log Analytics query/data-plane token is separate; use the loganalytics skill for KQL queries and ingestion

Endpoints

Skills

Toolchain

For KQL queries, workspace lifecycle, custom tables, DCE/DCR provisioning, and log ingestion, use the loganalytics skill.

Patterns & Caveats

• ARM async operations
• Key ARM paths (alertRules, watchlists, incidents, automationRules, dataConnectors)

Examples

Incident retrieval

./skills/sentinel/Get-SentinelIncident.ps1 `
  -SubscriptionId $subscriptionId `
  -ResourceGroupName $resourceGroupName `
  -WorkspaceName $workspaceName `
  -Status "Active" `
  -AuthContext $authContext

Alert rule enumeration

./skills/sentinel/Get-SentinelAlertRule.ps1 `
  -SubscriptionId $subscriptionId `
  -ResourceGroupName $resourceGroupName `
  -WorkspaceName $workspaceName `
  -AuthContext $authContext

Prerequisites

• Required modules
  • PowerShell 7.2+
  • MSAL.PS (only if you use certificate-based authentication and want MSAL token acquisition without Azure CLI fallback)
• Required roles
  • Microsoft Sentinel Reader (for viewing incidents and analytic rules)
  • Microsoft Sentinel Contributor (required if you perform management-plane write operations via ARM, for example when expanding this skill set beyond read-only retrieval)

Related Docs

• Auth Patterns
• Token Chaining
• Environment Endpoints