I've been working with a few clients to standardize their detection engineering workflows, and Azure Sentinel (now Microsoft Defender SIEM) keeps coming up. The promise of a cloud-native SIEM integrated with the rest of the Microsoft ecosystem is strong, but I'm trying to cut through the marketing.
Specifically, I'm curious about using it for the actual *engineering* part—building, testing, and managing detection rules as code. I've set up some basic KQL alerts, but moving beyond one-off queries into a structured process feels... clunky.
My main questions for anyone running it in production:
* **How do you manage detection rules (KQL) at scale?** Are you using the built-in Git integration with Azure DevOps, or another method like Terraform? I've seen the `Microsoft.SecurityInsights/alertRules` ARM template, but the schema is complex.
* **What's your workflow for testing rule logic before deployment?** Do you use a separate test workspace with synthetic data, or run queries against historical data in production?
* **Have you connected Sentinel to other parts of your stack (like a ticketing system or comms platform) using its built-in connectors/playbooks?** I'm used to tools like Zapier for this, but Logic Apps is the native route here.
Here's a snippet of a simple rule I templated, but managing dozens of these gets messy quickly:
```json
{
"properties": {
"displayName": "Multiple Failed Logons from Same Source",
"query": "SecurityEvent | where EventID == 4625 | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Count = count() by Account, IpAddress | where Count > 5",
"severity": "Medium",
"enabled": true,
"suppressionDuration": "PT1H",
"suppressionEnabled": false
}
}
```
I'm particularly interested in how you handle the lifecycle—from development, to validation, to deployment and tuning. Does it feel like a developer-friendly platform, or more of an analyst-centric tool that you've had to build processes around?