Can AI agents automate Microsoft Sentinel?

Microsoft Sentinel is automatable today through Azure Resource Manager Security Insights REST APIs and a data-lake KQL REST API. This record is Sentinel SIEM and data lake, not CrowdStrike Falcon, Wiz, Splunk, or Microsoft Azure as a whole-cloud identity. The Sentinel REST APIs create and manage data connectors, analytic rules, incidents, and bookmarks. Incident list, get, create-or-update, delete, and run playbook are documented on management.azure.com under Microsoft.SecurityInsights. Data-lake queries POST to https://api.securityplatform.microsoft.com/lake/kql/v2/rest/query with an OAuth 2.0 bearer token from a user or a service principal. Microsoft documents a hosted Sentinel MCP interface with scenario-focused collections. Most MCP tools require onboarding to the Microsoft Sentinel data lake and at least the Security reader role. The data-exploration collection is hosted at https://sentinel.microsoft.com/mcp/data-exploration. Azure CLI exposes az sentinel for incidents, alert rules, connectors, and watchlists; many of those commands are marked Experimental. Connector catalogs were not opened. Computer-use viability is unassessed. API scores 8 and is the best path because ARM and KQL REST do not depend on data-lake MCP onboarding. MCP scores 7: official and useful, with that onboarding gate.

Best path today: api · Overall automatability: 8/10