What are MCP Servers?

MCP (Model Context Protocol) Servers are collections of KQL queries designed to enhance threat detection and analysis within Microsoft Sentinel.

How do MCP Servers improve threat detection?

They provide pre-built, optimized queries for faster, more accurate identification of threats and anomalies within large datasets.

Are MCP Servers customizable?

Yes, while providing ready-to-use queries, they are highly customizable to suit specific security needs and environments.

How often are MCP Servers updated?

The UBOS team regularly updates MCP Servers with new queries and enhancements to ensure access to the latest threat intelligence.

How do MCP Servers integrate with the UBOS platform?

They seamlessly integrate, allowing users to automate incident response, orchestrate security workflows, and build custom security solutions using UBOS’s AI Agent development capabilities.

What kind of data does MCP Servers process?

MCP Servers process logs and events data that ingested to Microsoft Sentinel. These logs and events can be from many sources (Azure AD, Defender, Sysmon and other sources).

What are the advantages of using ‘has’ instead of ‘contains’ in KQL?

Using ‘has’ is generally more efficient than ‘contains’ when searching for full words (greater than four characters) because the data is indexed.