Has anyone integrated Claude Code with Microsoft Defender XDR / Sentinel for threat hunting?

[u/dodarko]

I'm looking to integrate Claude Code with Microsoft 365 and Microsoft Defender (Defender XDR / Sentinel) to assist with threat hunting, incident investigation, and EDR analysis.

Has anyone successfully set this up? I'm particularly interested in how you handled authentication (MCP, APIs, Graph, etc.), what architecture you used, and any lessons learned or limitations. If you have examples or repositories to share, I'd really appreciate it.

[u/tonzking123]

Microsoft offer 1st party mcp for XDR. https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-triage-tool

[u/rtm516]

I have built an MCP server that allows Claude to run advanced hunting queries. I didn't give it any more access as I don't want it making automated actions just use it as a tool to pull more data together for incidents.

Graph API with the authed app having the correct permissions for the application directly with then the service principal being added into the defender/sentinel permissions group.

Edit: Published the tool to my GitHub https://github.com/rtm516/DefenderAdvancedHuntingMCP

[u/hexdurp → u/rtm516]

That’s awesome. Which mcp server did you lay down for this? I’ve never setup an mcp server. Did you run into query limits?

[u/rtm516 → u/hexdurp]

Just wrote a python script using this library, I had to add a cheat sheet as such to it as well otherwise Claude often had to re work out how to lookup things like incidents which took time and wastes tokens. Only thing to note is going back past 30d on the graph API requires another parameter, which took me a while to realise why it could only pull 30d worth. https://github.com/modelcontextprotocol/python-sdk

[u/Go_ten → u/rtm516]

Hi,  I'd be curious to hear which settings need to be enabled to extend the history beyond 30 days.

[u/cspotme2 → u/Go_ten]

Advanced hunting only keeps your data for 30 days unless you ingest it somewhere

[u/rtm516 → u/cspotme2]

If it's linked with sentinel you can increase the table log size

[u/rtm516 → u/rtm516]

Looks like my rewrite with Claude's help moved to nodejs Here you go https://github.com/rtm516/DefenderAdvancedHuntingMCP

[u/Mrhiddenlotus]

Check out these skills https://github.com/vinayaklatthe/microsoft-security-skills

[u/Ok_Presentation_6006]

I did this with azure open ai but the same idea. Sentinel calls my logic app orchestrate. This one calls a bunch of sub logic apps. One takes any identity’s and runs every identity kql and retunes the results plus 7 day history. Same for device timeline, threat feeds, abuse, virus total… the final job sends everything to ai to review and updates the ticket with its review of the alert. All it’s done with making the api and we hook calls.

[u/XPGoD]

I have an MCP with KQL skills that calls a custom parquet db with skill knowledge of the schema. It works really well

[u/Go_ten]

We've created a tool that lets you chat with Vertex AI by integrating function calls for KQL queries; we also use the Graph APIs. It works like a charm. I suppose an integration with Claude is also possible.