KQL Search

Query Details

UEBA High Priority Activity From MCP Client User Agents

Query

BehaviorAnalytics
| where InvestigationPriority >= 5
| mv-expand DevicesInsights
| extend UserAgent = (DevicesInsights.UserAgent)
| where isnotempty( UserAgent)
| where tolower( UserAgent) contains "mcp"

About this query

Explanation

This query is designed to identify unusual or potentially suspicious user activities in Microsoft Sentinel, specifically those involving a Model Context Protocol (MCP) client. Here's a simplified breakdown:

  1. Purpose: The query looks for high-priority security events related to user behavior that might indicate unauthorized or suspicious activity using MCP clients.

  2. Data Source: It examines the BehaviorAnalytics table, which contains user behavior data.

  3. Priority Filter: It focuses on events with an InvestigationPriority of 5 or higher, which are considered high priority.

  4. User Agent Extraction: The query expands the DevicesInsights field to extract the UserAgent string, which identifies the software or tool used by the device.

  5. MCP Identification: It filters for events where the UserAgent contains the string "mcp", indicating the involvement of an MCP client.

  6. Context: MCP clients are often used by AI agents and coding assistants to interact with cloud services. While these can be legitimate, they can also be used by attackers to mimic normal activity and access data stealthily.

  7. Usage: This query helps security analysts distinguish between legitimate AI agent activities and potentially harmful automated actions, allowing them to focus on reviewing suspicious cases.

  8. Customization: Analysts can adjust the priority threshold to broaden or narrow the scope of the search and exclude known, safe MCP integrations to reduce false positives. However, the query might also pick up unrelated user agents containing "mcp" and miss MCP clients that don't identify themselves in the user agent string.