Netwrix Auditor now supports natural language querying of Auditor investigation data through integration with the Model Context Protocol (MCP).
This means you can access Auditor investigation data via AI tools like Claude Desktop—without writing a single query. Simply ask questions in plain English — or any language you prefer — and get immediate, actionable answers. This enables you to quickly search for specific events without deep expertise in the Netwrix Auditor search interface, formulate complex searches across multiple criteria and fields, or identify patterns by correlating different activity events.
You remain in full control of the integration: the MCP server is deployed in your environment, you decide what data is accessible to AI tools, and all queries are logged and auditable—giving you speed and visibility without sacrificing oversight.
What You Can Do with MCP + Netwrix Auditor
Use natural language prompts to unlock insights from Netwrix Auditor investigations.
Here are just a few examples of questions you can ask:
- “Find activities related to the document ‘ProjectPhoenix.docx’ in SharePoint Online.”
- “Find all activities by ‘contractor_X’ involving file servers between 9 PM and 6 AM last week.”
- “List file access attempts on server ‘FS-HR’ immediately following failed logon events for the same user.”
Key Limitations
It’s important to understand what the MCP server cannot do:
- No State-in-Time (SIT) Data Access: The server cannot retrieve or analyze point-in-time snapshots. It cannot answer questions like “Who currently has access to this folder?” or “Who were the members of the ‘Admin’ group last Tuesday?”
- No Configuration Capabilities: The server cannot be used to configure Netwrix Auditor.
- Read-Only Access: The server only provides read access to historical activity records.
- Historical Data Only: The server queries existing audit data; it does not provide real-time monitoring or alerting.
How to Get Started
This integration is available now on GitHub. To try it, you’ll need:
- Netwrix Auditor installed and populated with data
- An MCP-compatible AI tool—such as Claude Desktop, Claude for Work, or Microsoft Copilot Studio
- Basic familiarity with Python or container tools
Access the MCP Server Implementation Here:
We’d Love to Hear From You
We’re always happy to hear from our users—what you like and what you hope to see in the future. Please share your thoughts below, and you might see one of your suggestions implemented soon!