Query the Log Baseline data from your own code or from an AI assistant. The REST API and the Model Context Protocol (MCP) server are read-only, free, and need no key. Both return the same data.
Responses use dataset version 0.5.1. The baseline is generic, so check its recommendations against your own tenant.
Endpoints
Both endpoints offer the same operations with the same parameters.
claude mcp add --transport http log-baseline https://mcp.baseline.infernux.no/mcp
API reference
In REST, each operation is a GET request. In MCP, it is a tool call with the operation id as the tool name. Both take the same parameters and check them the same way. The sample responses are real output from dataset version 0.5.1.
Dataset
Dataset info (get_dataset_info)
Version, provenance, and record counts of the Log Baseline dataset that every other operation reads.
GET/v1/manifest
Parameters
None.
Responses
Responses for Dataset info
Status
Description
200
The dataset version, the source repository and revision, and record counts.
429
Too many requests. Wait the number of seconds in Retry-After.
Lists are cut to two items and long text is shortened.
Get table (get_table)
Full baseline record for one table: classification, tier, value and tier rules with ASD and CISA mappings, evidence, shared sources, and baselines that include it.
GET/v1/tables/{tableName}
Parameters
Parameters for Get table
Name
Type
Description
tableName required
stringin path
Log Analytics table name, for example SigninLogs. Case-insensitive.
Responses
Responses for Get table
Status
Description
200
The full table record.
400
A parameter is invalid or unknown. The body lists each issue.
404
No item has that id.
429
Too many requests. Wait the number of seconds in Retry-After.
{
"items": [
{
"id": "minimum",
"label": "Minimum",
"summary": "Core Microsoft identity, Sentinel, Azure control-plane, and Microsoft 365 audit coverage.",
"guidance": "Use this as a starting floor when the listed services are present. It favors broadly useful investigation records over comprehensive telemet…",
"tableCount": 8
},
{
"id": "recommended",
"label": "Recommended",
"summary": "Adds Microsoft Graph, common Azure resource logs, and behavior analytics.",
"guidance": "Use this when the relevant products and Azure services are deployed. Resource-specific tables should only be enabled for resources that exis…",
"tableCount": 16
}
]
}
Lists are cut to two items and long text is shortened.
Get baseline (get_baseline)
One pre-made baseline with the reason each table is included and the full table records. Each level includes the levels below it.
GET/v1/baselines/{level}
Parameters
Parameters for Get baseline
Name
Type
Description
level required
stringin path
One of minimum, recommended, plus.
Responses
Responses for Get baseline
Status
Description
200
The baseline, why each table is included, and the full table records.
400
A parameter is invalid or unknown. The body lists each issue.
404
No item has that id.
429
Too many requests. Wait the number of seconds in Retry-After.
{
"id": "minimum",
"label": "Minimum",
"summary": "Core Microsoft identity, Sentinel, Azure control-plane, and Microsoft 365 audit coverage.",
"guidance": "Use this as a starting floor when the listed services are present. It favors broadly useful investigation records over comprehensive telemet…",
"tableCount": 8,
"logTypes": [
"Alert",
"Audit"
],
"additions": [
{
"tableName": "SigninLogs",
"reason": "Interactive authentication is the starting point for account access investigations."
},
{
"tableName": "AuditLogs",
"reason": "Directory changes expose role, application, group, and policy modifications."
}
],
"tables": [
{
"tableName": "SigninLogs",
"connector": "Microsoft Entra ID",
"classification": "primary",
"valueRule": "C2",
"category": "Identity & Access",
"description": "Interactive user sign-in events from Microsoft Entra ID including MFA, conditional access, and location",
"keywords": [
"sign-in",
"login"
],
"mitreSources": [
"User Account: Authentication",
"Logon Session: Logon Session Creation"
],
"recommendedTier": "analytics",
"tierRule": "T1",
"volumeClass": "medium",
"volumeDriver": "sign-in",
"isFree": false,
"recommendedRetentionDays": 365,
"sourceIds": [
"log-horizon-classifications",
"log-baseline-volume-model"
],
"domainId": "identity",
"logTypeId": "authentication"
},
{
"tableName": "AuditLogs",
"connector": "Microsoft Entra ID",
"classification": "primary",
"valueRule": "C3",
"category": "Identity & Access",
"description": "Entra ID directory audit events including user, group, role, and application changes",
"keywords": [
"audit",
"entra"
],
"mitreSources": [
"User Account: User Account Modification",
"Active Directory: Active Directory Object Modification"
],
"recommendedTier": "analytics",
"tierRule": "T1",
"volumeClass": "medium",
"volumeDriver": "admin-action",
"isFree": false,
"recommendedRetentionDays": 365,
"sourceIds": [
"log-horizon-classifications",
"log-baseline-volume-model"
],
"domainId": "identity",
"logTypeId": "authentication"
}
]
}
Lists are cut to two items and long text is shortened.
Rules and taxonomy
Get classification rules (get_rules)
Value rules C1-C9 with ASD and CISA mappings, tier rules T1-T5, the classification/tier matrix with live counts, the volume model, and data lake limits.
GET/v1/rules
Parameters
None.
Responses
Responses for Get classification rules
Status
Description
200
Value rules, tier rules, the matrix with table counts, the volume model, and data lake limits.
429
Too many requests. Wait the number of seconds in Retry-After.
Example request
curl "https://api.baseline.infernux.no/v1/rules"
MCP tool call
{"name":"get_rules","arguments":{}}
Sample response
{
"guidance": {
"acsc": "https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/implementing-siem-soar-platforms/priority-logs-fo…",
"cisa": "https://www.cisa.gov/sites/default/files/2023-02/TLP%20CLEAR%20-%20Guidance%20for%20Implementing%20M-21-31_Improving%20the%20Federal%20Gover…",
"tableFeatures": "https://learn.microsoft.com/azure/azure-monitor/reference/tables-features"
},
"valueRules": [
{
"id": "C1",
"title": "Detections and findings",
"classification": "primary",
"records": "Detections, alerts, incidents, security findings (vulnerability and posture findings), and detection pipeline health",
"acsc": [
{
"section": 1,
"title": "Endpoint detection and response (EDR) logs",
"detail": "EDR detections"
},
{
"section": 2,
"title": "Network device logs",
"detail": "IDS/IPS alerts"
}
],
"cisa": []
},
{
"id": "C2",
"title": "Authentication and credential use",
"classification": "primary",
"records": "Authentication and credential use, including non-interactive, service principal, managed identity, federated, VPN, NAC, and password vault a…",
"acsc": [
{
"section": 2,
"title": "Network device logs",
"detail": "VPN and NAC"
},
{
"section": 3,
"title": "Microsoft Domain Controller",
"detail": null
}
],
"cisa": [
{
"section": 1,
"title": "Identity, credential, and access management (ICAM)",
"detail": "1b Track usage of credentials"
}
]
}
],
"tierRules": [
{
"id": "T1",
"tier": "analytics",
"title": "Near-real-time detection",
"when": "Generic detections need near-real-time matching on single events."
},
{
"id": "T2",
"tier": "analytics",
"title": "Enrichment or join target",
"when": "Low-volume enrichment or join target for analytics-tier detections or Sentinel features."
}
],
"matrix": [
{
"id": "primary-analytics",
"classification": "primary",
"tier": "analytics",
"valueRules": "C1-C8",
"tierRules": [
"T1",
"T2"
],
"definition": "High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.",
"tableCount": 350,
"rulePairs": [
{
"valueRule": "C1",
"tierRule": "T1",
"count": 130
},
{
"valueRule": "C3",
"tierRule": "T1",
"count": 61
}
]
},
{
"id": "primary-datalake",
"classification": "primary",
"tier": "datalake",
"valueRules": "C1-C8",
"tierRules": [
"T3",
"T4"
],
"definition": "High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.",
"tableCount": 239,
"rulePairs": [
{
"valueRule": "C5",
"tierRule": "T3",
"count": 176
},
{
"valueRule": "C5",
"tierRule": "T4",
"count": 35
}
]
}
],
"volumeClasses": [
"low",
"medium"
],
"volumeDrivers": [
{
"driver": "alert",
"defaultClass": "low"
},
{
"driver": "admin-action",
"defaultClass": "low"
}
],
"dataLakeLimits": [
"Data lake ingestion latency is up to 15 minutes.",
"A scheduled KQL job starts at least 30 minutes after it is created."
]
}
Lists are cut to two items and long text is shortened.
Get taxonomy (get_taxonomy)
Domains and log types used to group tables, with active table counts.
GET/v1/taxonomy
Parameters
None.
Responses
Responses for Get taxonomy
Status
Description
200
Domains with their log types and active table counts.
429
Too many requests. Wait the number of seconds in Retry-After.
Lists are cut to two items and long text is shortened.
Statistics
Get statistics (get_stats)
The numbers behind the stats page: totals, the classification/tier matrix, tables per domain and value rule, ACSC and CISA coverage, volume against the matrix, tier and retention, and the tables most referenced by public detection rules. Covers active tables only.
GET/v1/stats
Parameters
None.
Responses
Responses for Get statistics
Status
Description
200
Totals and breakdowns of the active tables, with counts split by tier.
429
Too many requests. Wait the number of seconds in Retry-After.
Lists are cut to two items and long text is shortened.
Get field statistics (get_field_stats)
The fields most referenced by public detection rules, across all active tables or narrowed to a domain or log type. Use get_table_fields for one table.
GET/v1/stats/fields
Parameters
Parameters for Get field statistics
Name
Type
Description
domain
stringin query
Taxonomy domain id. See get_taxonomy. One of identity, endpoint, network, cloud, email-collaboration, applications-workloads, data-security, infrastructure-platform, security-operations, threat-intelligence.
logType
stringin query
Taxonomy log type id. See get_taxonomy. One of activity, alert, application, audit, authentication, configuration, container, data-access, diagnostic, endpoint-telemetry, health, network-flow, posture, security-event, storage-access, threat-indicator, vulnerability.
limit
integerin query
Maximum fields to return. Default 25.
Responses
Responses for Get field statistics
Status
Description
200
Fields with their reference counts, most referenced first, and how many tables were counted.
400
A parameter is invalid or unknown. The body lists each issue.
429
Too many requests. Wait the number of seconds in Retry-After.
{
"total": 13,
"limit": 2,
"offset": 0,
"nextOffset": 2,
"items": [
{
"id": "data-lake-tier",
"term": "Data lake tier",
"definition": "Low-cost, long-term storage in the Microsoft Sentinel data lake. Data is queried on demand, searched at scale, or summarized into the analyt…",
"links": [
{
"label": "Microsoft: Data lake tier",
"href": "https://learn.microsoft.com/azure/sentinel/log-plans#data-lake-tier"
},
{
"label": "Microsoft: Sentinel data lake overview",
"href": "https://learn.microsoft.com/azure/sentinel/datalake/sentinel-lake-overview"
}
],
"sectionId": "tiers",
"section": "Sentinel tiers"
},
{
"id": "mirroring",
"term": "Mirroring",
"definition": "Data ingested into the analytics tier is also written to the data lake tier as a single copy. The lake therefore always holds the full datas…",
"sectionId": "data-movement",
"section": "Data movement"
}
]
}
Lists are cut to two items and long text is shortened.
Get dictionary term (get_term)
One dictionary term with its definition and links.
GET/v1/dictionary/{termId}
Parameters
Parameters for Get dictionary term
Name
Type
Description
termId required
stringin path
Term id from search_terms.
Responses
Responses for Get dictionary term
Status
Description
200
The term with its definition, section, and links.
400
A parameter is invalid or unknown. The body lists each issue.
404
No item has that id.
429
Too many requests. Wait the number of seconds in Retry-After.
{
"id": "primary",
"term": "Primary",
"definition": "A table whose value rule is one of C1 to C8: detections and findings, authentication, identity and configuration changes, endpoint and opera…",
"links": [
{
"label": "Methodology: Value rules",
"href": "/methodology/#value-rules"
},
{
"label": "Building a practical log baseline",
"href": "https://infernux.no/blog/buildingapracticallogbaseline/"
}
],
"sectionId": "classification",
"section": "Classification"
}
Lists are cut to two items and long text is shortened.
Limits and behavior
Rate limits
Each client can send about 120 REST requests and 60 MCP requests per minute. Above that, you get HTTP 429 and a Retry-After header with the number of seconds to wait.
Paging
List operations take limit (1-100, default 25) and offset. Responses include total and nextOffset, which is null on the last page.
Caching
REST responses include an ETag and can be cached for an hour. Send it back in If-None-Match to get 304 Not Modified when the data hasn't changed.
Versions
The X-Baseline-Version header shows the dataset version. If a response changes in a way that breaks clients, it moves to a new path, such as /v2.
Errors
Errors return JSON with error and message. A 400 also lists what failed validation, including unknown parameters. In MCP, the tool result has isError set and the same body.
Cold starts
The services shut down when idle. The first request after a quiet period can take a few seconds.
Usage data
Each request creates one usage record with metadata only. Records are kept for 30 days. They show which data is used and help stop abuse. A record contains:
REST or MCP, the operation name, and the HTTP status
The names of the parameters you sent, but not their values
The table, source, baseline, or term you looked up, if it exists in the dataset
Duration, response size, result count, and dataset version
The client type from the User-Agent header, such as curl or browser, and the name and version an MCP client sends
A hash of your IP address, or of the /64 network for IPv6
Search text, parameter values, and IP addresses are not stored. The IP hash uses a secret key, so it can't be matched back to an address without that key. It makes it possible to rate limit or block one client. Blocked clients get HTTP 403. If you think you were blocked by mistake, open an issue .