Microsoft Sentinel website screenshot

Microsoft Sentinel

Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution. It provides REST APIs for managing incidents, analytics rules, threat intelligence, and automation playbooks.

Microsoft Sentinel publishes 5 APIs on the APIs.io network, including AlertRules API, Bookmarks API, DataConnectors API, and 2 more. Tagged areas include Microsoft, Security, SIEM, SOAR, and Threat Detection.

Microsoft Sentinel’s developer surface includes authentication, developer portal, documentation, pricing, getting-started guide, support, engineering blog, and 8 more developer resources.

🌐 Visit website 📡 Source on GitHub
51.2/100 developing ▬ flat Agent 31/100 agent aware Full breakdown ↓
scored 2026-08-05 · rubric v0.9.1
AccessFreemiumSelf serve⚡ Free to try
5 APIs
MicrosoftSecuritySIEMSOARThreat Detection

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-08-05 · rubric v0.9.1
Composite quality — 51.2/100 · developing
Contract Quality 13.6 / 25
Developer Ergonomics 9.1 / 20
Commercial Clarity 14.2 / 20
Operational Transparency 6.8 / 13
Governance 0.0 / 12
Discoverability 7.4 / 10
Agent readiness — 31/100 · agent aware
Machine-Readable Contract 18 / 18
Agentic Access Contract 10 / 10
MCP Server 0 / 12
Machine-Readable Auth 10 / 10
Idempotency 0 / 9
Stable Error Semantics 0 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 7 / 7
Typed Event Surface 0 / 6
Agent Skills 0 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
A2A Agent Card 0 / 8
Dry-Run / Simulate Mode 0 / 4
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/microsoft-sentinel: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 5

Individual APIs this provider publishes, each with its own machine-readable definition.

Microsoft Sentinel AlertRules API

The AlertRules API from Microsoft Sentinel — 2 operation(s) for alertrules.

Microsoft Sentinel Bookmarks API

The Bookmarks API from Microsoft Sentinel — 1 operation(s) for bookmarks.

Microsoft Sentinel DataConnectors API

The DataConnectors API from Microsoft Sentinel — 1 operation(s) for dataconnectors.

Microsoft Sentinel Incidents API

The Incidents API from Microsoft Sentinel — 2 operation(s) for incidents.

Microsoft Sentinel ThreatIntelligence API

The ThreatIntelligence API from Microsoft Sentinel — 1 operation(s) for threatintelligence.

Open Collections 1

Open, tool-agnostic API collections (OpenAPI-derived and Bruno).

Microsoft Sentinel REST API

OPEN COLLECTION

Pricing Plans 1

Published pricing tiers and plan structures.

Microsoft Sentinel Plans Pricing

3 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Microsoft Sentinel Rate Limits

5 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Microsoft Sentinel Finops

FINOPS

Security Posture 2

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Microsoft Sentinel Authentication

http · 1 scheme

SECURITY

Microsoft Sentinel Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Agentic Access 1

Recommended x-agentic-access execution contracts for AI agents.

Microsoft Sentinel Agentic Access

11 operations · 4 acting

11 operations · 4 acting

AGENTIC

Resources

Get Started 2

Portal, sign-up, and the first successful call

Portal
Portal
 GettingStarted
GettingStarted

Documentation 1

Reference material describing how the API behaves

Documentation
Documentation

Agent Surfaces 1

MCP servers, agent skills, and machine-readable catalogs

AgenticAccess
AgenticAccess

Build 1

SDKs, sample code, and the tooling you integrate with

GitHubOrganization
GitHubOrganization

Access & Security 3

Authentication, authorization, and security posture

DomainSecurity
DomainSecurity
 Authentication
Authentication
 Authentication
Authentication

Operate 2

Status, limits, changes, and where to get help

Support
Support
 StatusPage
StatusPage

Commercial 3

Pricing, plans, and the legal terms of use

Pricing
Pricing
 TermsOfService
TermsOfService
 PrivacyPolicy
PrivacyPolicy

Company 2

The organization behind the API

Website
Website
 Blog
Blog

Source (apis.yml)

apis.yml Raw ↑ 
aid: microsoft-sentinel
name: Microsoft Sentinel
description: Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration,
  automation, and response (SOAR) solution. It provides REST APIs for managing incidents, analytics rules, threat intelligence,
  and automation playbooks.
type: Index
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Freemium · Self-serve signup
  confidence: high
  source:
  - plans
  - authentication
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/microsoft-sentinel.png
tags:
- Microsoft
- Security
- SIEM
- SOAR
- Threat Detection
url: https://raw.githubusercontent.com/api-evangelist/microsoft-sentinel/refs/heads/main/apis.yml
created: '2024-01-01'
modified: '2026-05-19'
specificationVersion: '0.19'
apis:
- aid: microsoft-sentinel:microsoft-sentinel-alertrules-api
  name: Microsoft Sentinel AlertRules API
  description: The AlertRules API from Microsoft Sentinel — 2 operation(s) for alertrules.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - AlertRules
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-alertrules-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-bookmarks-api
  name: Microsoft Sentinel Bookmarks API
  description: The Bookmarks API from Microsoft Sentinel — 1 operation(s) for bookmarks.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - Bookmarks
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-bookmarks-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-dataconnectors-api
  name: Microsoft Sentinel DataConnectors API
  description: The DataConnectors API from Microsoft Sentinel — 1 operation(s) for dataconnectors.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - DataConnectors
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-dataconnectors-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-incidents-api
  name: Microsoft Sentinel Incidents API
  description: The Incidents API from Microsoft Sentinel — 2 operation(s) for incidents.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - Incidents
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-incidents-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-threatintelligence-api
  name: Microsoft Sentinel ThreatIntelligence API
  description: The ThreatIntelligence API from Microsoft Sentinel — 1 operation(s) for threatintelligence.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - ThreatIntelligence
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-threatintelligence-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
common:
- type: AgenticAccess
  url: agentic-access/microsoft-sentinel-agentic-access.yml
- type: DomainSecurity
  url: security/microsoft-sentinel-domain-security.yml
- type: Authentication
  url: authentication/microsoft-sentinel-authentication.yml
- type: GitHubOrganization
  url: https://github.com/Azure
- type: Portal
  url: https://portal.azure.com/
- type: Website
  url: https://azure.microsoft.com/en-us/products/microsoft-sentinel/
- type: Documentation
  url: https://learn.microsoft.com/en-us/azure/sentinel/
- type: Pricing
  url: https://azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/
- type: GettingStarted
  url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- type: Authentication
  url: https://learn.microsoft.com/en-us/azure/active-directory/develop/
- type: TermsOfService
  url: https://www.microsoft.com/en-us/legal/terms-of-use
- type: PrivacyPolicy
  url: https://privacy.microsoft.com/en-us/privacystatement
- type: Support
  url: https://support.microsoft.com/
- type: StatusPage
  url: https://status.azure.com/
- url: https://techcommunity.microsoft.com/t5/s/gxcuf89792/rss/board?board.id=MicrosoftSentinelBlog
  type: Blog
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com