Manage Sentinel Detection-as-Code with Terraform

Security operations teams used to click through the Microsoft Sentinel portal to create and edit analytics rules, automation rules, and watchlists - an approach that quietly drifts out of sync, leaves no review trail, and cannot be promoted reliably from a test workspace to production. Detection-as-Code treats detection content as software: every analytics rule, automation rule, and watchlist is declared in version-controlled Terraform, reviewed in a pull request, and rolled out by terraform plan/apply so the deployed state always matches what is committed. The payoff is fleet-scale consistency - one parameterized definition can manage many rules - and controlled, auditable change, because Terraform shows you the exact diff before anything touches the live workspace.

In this lab, you will start from a baseline Sentinel workspace and manage its detection content entirely through Terraform. You will collapse multiple scheduled analytics rules into a single for_each block driven by a locals map, add a Sentinel automation rule and a watchlist as code, then change one rule's severity and threshold and re-apply - watching terraform plan produce a clean, targeted diff that updates only the intended rule.

Objectives

Upon completion of this advanced level lab, you will be able to:

• Apply a provided Terraform baseline (workspace plus Sentinel onboarding) to get a managed workspace
• Manage two to three scheduled analytics rules from a single for_each block driven by a locals map
• Deploy a Sentinel automation rule and a watchlist as code so triage logic and reference data live in the same repo as the detections
• Make a controlled change to one rule's severity and threshold, then run terraform plan for a clean targeted diff
• Re-apply and verify the live rule reflects the update with no unintended drift

Who is this lab for?

This lab is designed for:

• Detection engineers operating Sentinel content at scale
• SOC platform engineers managing detections as code
• Cloud security engineers comfortable with Sentinel rule types and basic terraform plan/apply