Microsoft Sentinel APIs


This package contains functionality making calls to Microsoft Sentinel directly. These can be used to get data from Microsoft Sentinel, as well as perform configuration and other actions on the Microsoft Sentinel Workspace

Microsoft Sentinel API documentation

The first step in using this package is to install the msticpy package.

!pip install msticpy --upgrade --user
Collecting msticpy
Building wheels for collected packages: msticpy
  Building wheel for msticpy ( started
  Building wheel for msticpy ( finished with status 'done'
Successfully built msticpy
Installing collected packages: msticpy
Successfully installed msticpy-0.3.0
from import AzureData, MicrosoftSentinel
print('Imports Complete')
Imports Complete

Instantiating and Connecting the Microsoft Sentinel API Connector

See Microsoft Sentinel

When instantiating the class you need to pass it details of the Sentinel workspace you want to interact with. This can be provided as a complete resource ID, e.g.


Alternatively you can provide the Subscription ID, Resource Group name and Workspace name seperately and let the class build the resource ID for you. Alternatively you can provide the Subscription ID, Resource Group name and Workspace name. e.g.


If no workspace details are provided it will attempt to use default workspace details from your config file.

You can also specify a specific Azure Cloud if your workspace isn’t in Azure’s public cloud.

In order to connect to the Microsoft Sentinel API and retrieve the required data we need to instantiate the MicrosoftSentinel class and authenticate to Azure. Authentication to the Microsoft Sentinel API is handled via an the azure_auth package.

By default [‘env’, ‘cli’, ‘msi’, ‘interactive’] is used but you can provide an alternative list to .connect via the auth_methods parameter.

azs = MicrosoftSentinel()

Get Microsoft Sentinel Workspaces

See list_sentinel_workspaces

If you want to see Sentinel workspace in a subscription you can call list_sentinel_workspaces.

list_sentinel_workspaces returns a list of Microsoft Sentinel workspaces within a specified subscription.


this will only return workspaces that the authenticated account is permitted to view.



It is possible to get details of, update, and create Incidents via the MicrosoftSentinel connector. Details on working with Incidents can be found in Sentinel Incidents

Hunting Queries

You can return a dataframe detailing all hunting queries configured in the workspace. This allows for analysis and configuration of hunting queries, as well as the ability to take a hunting query and run it with a QueryProvider.

See list_hunting_queries



You can interact with Analytics and Analytic templates, including creating new analytics via this feature. More details can be found in Sentinel Analytics


You can interact with Bookmarks, including creating new bookmarks and deleting existing bookmarks via this feature. More details can be found in Sentinel Bookmarks


You can interact with Watchlists, including creating new watchlists and adding items to a watchlist via this feature. More details can be found in Sentinel Watchlists