Notebooks & the Sentinel MCP Server
For advanced hunting, step beyond KQL. Learn how to use Jupyter notebooks in Sentinel for complex analysis and connect to the Sentinel MCP Server for AI-assisted hunting.
Beyond KQL: when notebooks shine
KQL is your everyday tool. Notebooks are your power tool.
Sometimes a hunt requires more than KQL can offer: machine learning on entity behaviour, statistical analysis across months of data, integration with external threat intel APIs, or custom visualisations that go beyond Sentinel’s built-in charts.
Jupyter notebooks in Sentinel let you combine KQL queries with Python code, creating advanced investigation and hunting workflows. The Sentinel MCP Server (Model Context Protocol) takes this further — it lets AI tools (like Copilot) connect directly to your Sentinel data for AI-assisted hunting.
Sentinel notebooks
What notebooks add over KQL
| Capability | KQL Alone | KQL + Notebook |
|---|---|---|
| Statistical analysis | Basic (percentile, variance) | Full Python stats (scipy, numpy) |
| Machine learning | Limited (anomaly rules) | Scikit-learn, custom models |
| Visualisation | Basic charts | Matplotlib, Plotly, interactive maps |
| External APIs | Not supported | Call VirusTotal, Shodan, AbuseIPDB |
| Data manipulation | KQL operators | Pandas DataFrames for complex transforms |
| Workflow automation | Run query, get results | Multi-step investigation with conditional logic |
Common notebook use cases
| Use Case | What the Notebook Does |
|---|---|
| Entity behaviour profiling | Query 90 days of sign-in data, build a statistical profile of “normal” for each user, flag deviations |
| Threat intel enrichment | Take IP addresses from an incident, query VirusTotal and Shodan APIs, merge results with Sentinel data |
| Geospatial analysis | Map IP addresses to locations, visualise attack origins on an interactive world map |
| Timeline reconstruction | Query multiple tables, merge into a unified timeline, render as an interactive visualisation |
| Anomaly scoring | Apply machine learning models to identify entities with unusual behaviour patterns |
How notebooks work in Sentinel
- Launch from the Sentinel Notebooks page or from an incident
- Connect to your Sentinel workspace using the
msticpylibrary - Query data using KQL through the notebook connector
- Analyse with Python — transform, enrich, model
- Visualise results with charts, graphs, and maps
- Document findings in the notebook (code + output + markdown = reproducible investigation)
Scenario: Zoe helps Tyler with a notebook investigation
Tyler at CipherStack suspects a slow-and-low data exfiltration over DNS. KQL finds long DNS queries, but Tyler needs to determine if the domain patterns are truly encoded data or just legitimate CDN subdomains.
Tyler asks Zoe (data scientist) to help:
Zoe creates a notebook that:
- Queries 30 days of DNS events from Sentinel
- Extracts subdomain strings from each query
- Calculates entropy of each subdomain (encoded data has higher entropy than normal names)
- Uses a machine learning classifier trained on known DNS tunnelling patterns
- Scores each domain on a 0-1 scale of tunnelling probability
Results: 4 domains score above 0.9 — confirmed DNS tunnelling from a compromised developer machine. The notebook evidence is saved and attached to the incident.
The Sentinel MCP Server
What is MCP?
Model Context Protocol (MCP) is a standardised protocol that allows AI tools to connect to data sources. The Sentinel MCP Server exposes your Sentinel workspace to AI assistants, enabling them to:
- Run KQL queries against your data
- List available tables and schemas
- Execute hunting queries
- Retrieve incident and entity information
- Analyse results using AI reasoning
Why MCP matters for hunting
| Without MCP | With MCP |
|---|---|
| AI tools cannot access your security data | AI tools query Sentinel directly |
| You copy-paste data between tools | AI assistants work with live data |
| Investigation is manual and slow | AI chains multiple queries automatically |
| Each analyst works in isolation | AI can surface patterns across the team’s data |
Connecting to the Sentinel MCP Server
- Enable the MCP Server in your Sentinel workspace settings
- Configure access permissions (which AI tools can connect, with what scope)
- Connect from an AI assistant (e.g., Copilot, a custom agent) using the MCP endpoint
- The AI can now query your Sentinel data as part of its reasoning process
Exam tip: MCP is new but tested
The Sentinel MCP Server is a recent addition to the exam (April 2026 update). The exam tests:
- What it is — a protocol for AI tools to connect to Sentinel data
- What it enables — AI-assisted hunting, automated query execution, live data access
- Where it connects — to Jupyter notebooks and external AI assistants
You do NOT need to know MCP protocol details. Focus on the use case: enabling AI tools to hunt in your Sentinel data.
Course complete: Domain 3 summary
You have completed all three domains of SC-200:
| Domain | Weight | Modules | Key Skills |
|---|---|---|---|
| 1. Manage a Security Operations Environment | 40-45% | 12 | Sentinel workspace, data connectors, MDE, automation, detections, MITRE |
| 2. Respond to Security Incidents | 35-40% | 10 | Triage, investigation across Defender products, Copilot, complex attacks, endpoint response |
| 3. Perform Threat Hunting | 20-25% | 6 | KQL, Advanced Hunting, Sentinel hunting, threat analytics, Data lake, notebooks |
Exam strategy: final review checklist
Before the exam, ensure you can:
- Write KQL — table selection, operators, cross-table joins
- Choose the right detection type — NRT vs scheduled vs TI vs anomaly
- Trace an attack chain — initial access through exfiltration
- Know role boundaries — Reader vs Responder vs Contributor vs Playbook Operator
- Distinguish products — which product detects which threat (Entra vs MDI vs MDCA vs MDE)
- Understand automation levels — Full vs Semi vs No automation
- Use the right investigation tool — timeline vs live response vs investigation package
- Handle Data lake — search jobs for historical queries, summary rules for ongoing aggregation
Good luck with SC-200!
Tyler wants to determine if long DNS queries from a developer machine are DNS tunnelling or legitimate CDN traffic. KQL alone cannot make this distinction. What tool should he use?
An AI assistant needs to query Pacific Meridian's Sentinel workspace to assist with hunting. What Sentinel feature enables this?
Congratulations! You have completed all 28 modules of the SC-200 study guide. Time to practise with exam-style questions and review any areas where you felt less confident. Good luck with your certification!