← writeups · July 10, 2026

Automating Tier 1 Incident Response with MCP and RAG

How I connected Microsoft Sentinel, Entra ID, and internal runbooks to an AI agent — and cut MTTR by 25%.

✏️ This is a starter writeup based on my resume — I’ll expand it with details as I document more of my work. To add a new writeup, drop a .md file in src/content/writeups/ with the same frontmatter fields.

The problem

Tier 1 incident triage is repetitive by design: enrich the alert, check the user’s sign-in history, look up the device, follow the runbook. Analysts were spending most of their shift doing lookups a machine could do — and MTTR showed it.

The approach

I built an enterprise Model Context Protocol (MCP) framework backed by an Azure AI Foundry RAG system:

• MCP servers expose Sentinel incidents, Entra ID sign-in logs, and device posture as tools the agent can call.
• RAG over internal SOPs grounds every recommendation in our actual runbooks, not generic advice.
• Human-in-the-loop gates keep containment actions behind analyst approval.

Results

• 25% reduction in MTTR for Tier 1 and Tier 2 incidents
• Analysts start from an enriched, pre-investigated incident instead of a raw alert
• Runbook knowledge that used to live in senior analysts’ heads is now queryable

What I’d do differently

More on this soon — including the guardrails design and how we evaluated agent accuracy before letting it touch production incidents.