Microsoft Sentinel

Connect your own Microsoft Sentinel workspace by saving an Azure AD App Registration's tenant/client id + client secret plus the workspace's subscription id, resource group, and workspace name, after checking both OAuth2 audiences (ARM + Log Analytics Query) actually work. Create the App Registration in Azure AD > App registrations, grant it Microsoft Sentinel Contributor (or Reader) + Log Analytics Reader on the resource group.

List the connected Microsoft Sentinel workspaces.

Disconnect a Microsoft Sentinel workspace: deletes the saved App Registration credentials. Nothing in Sentinel/Azure itself is changed.

List Sentinel incidents in the connected workspace, optionally filtered by status.

Read one Sentinel incident in full by its name (GUID).

Update a Sentinel incident's status, severity, owner, classification, and/or labels. Closing an incident requires classification and classification_reason.

Add a comment to a Sentinel incident, for handoff notes and triage context.

List the comments on a Sentinel incident.

List analytics (alert) rules configured on the connected Sentinel workspace.

Enable or disable an analytics rule without deleting it.

List automation rules (SOAR playbook triggers) configured on the connected Sentinel workspace.

Enable or disable an automation rule without deleting it.

List watchlists (e.g. blocked IPs, VIP users) configured on the connected Sentinel workspace.

Create a new watchlist (e.g. a list of known-bad IPs) on the connected Sentinel workspace.

List the rows/items inside a watchlist.

Add a row/item to a watchlist.

List threat intelligence indicators (IOCs) on the connected Sentinel workspace.

Push a new threat intelligence indicator (IOC) -- e.g. a malicious IP, domain, or file hash -- into Sentinel.

List saved hunting bookmarks on the connected Sentinel workspace.

Save a KQL query as a hunting bookmark for later reference.

List data connectors (log source integrations) configured on the connected Sentinel workspace.

Run a KQL (Kusto Query Language) query against the connected Sentinel workspace's Log Analytics data -- e.g. 'SecurityAlert | take 20'. Read-only investigation.

Build one aggregated health report across the connected Sentinel workspace: open incidents, unassigned High/Medium incidents older than a threshold, and disabled high-severity analytics rules.