I've been running Sentinel in a multi-subscription AWS environment for about 18 months, using Terraform for provisioning and management. The core promise is solid, but the operational reality has sharp edges, especially when you scale.
My setup uses a centralized Log Analytics workspace with data connectors for CloudTrail, GuardDuty, and VPC Flow Logs via Event Hubs. The Terraform for the foundational resources is straightforward, but the real complexity starts with analytics rules and automation.
Here are the main friction points I've hit:
* **State Management for Security Content:** Managing hundreds of analytics rules, watchlists, and playbooks as code is painful. The AzureRM provider works for resources, but the `azapi` provider or ARM templates are often needed for security content. This creates a split state. I now use a dedicated Terraform state for Sentinel objects, but drift detection is manual and tedious.
* **Cost Surprises:** The pricing model is a trap for the unwary. Ingesting VPC Flow Logs at scale generated a massive bill before we tuned filtering. You must be aggressive with basic logging early on.
* **Playbook Development:** Logic Apps are the weak link. The developer experience is poor, and versioning/reuse is an afterthought. We've started wrapping common patterns in Azure Functions called by the playbooks, just to get proper code control.
The threat hunting queries (KQL) are powerful, and the integration with other Microsoft 365 signals is valuable. But the platform feels like two separate products bolted together: a good analytics engine and a clunky, low-code automation suite.
For those running it at scale, how are you handling:
* CI/CD for analytics rules and hunting queries?
* Secrets management within playbooks without using hard-coded values in Logic App definitions?
* Reliable drift detection for the entire Sentinel configuration?
plan before apply