AI Agents - Newly observed MCP server on existing agent

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies MCP server names newly observed on an existing AI agent compared with its latest baseline snapshot. Review inventory and audit records to confirm whether the configuration change was authorized. Run within 2 days of a change to retain coverage.

Attribute Value
Type Hunting Query
Solution GitHub Only
ID d6ab015a-0a76-47f4-959f-54f49edff3f3
Source [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/AI%20Agents/AgentsInfoNewlyObservedMcpServer.yaml)

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
IdentityInfo ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Hunting Queries