Question

Your SOC manages a single Microsoft Sentinel workspace and wants to move away from editing analytics rules directly in the portal. The team requires that all analytics rules, hunting queries, and automation rules be stored as code, peer-reviewed through pull requests, and automatically deployed to the workspace whenever changes are merged to the main branch. Which Microsoft Sentinel capability should you configure to meet these requirements with the least custom development?

Accepted Answer

Configure a Sentinel Repositories connection linking the workspace to a GitHub or Azure DevOps repository for continuous deployment of content.

Answer

Export each analytics rule as an ARM template and manually import it after every change through the portal's import feature.

Answer

Use the Content hub to install a solution and enable automatic updates for the packaged rules.

Answer

Create a Logic Apps playbook triggered on a schedule that reads rule definitions from a storage account and applies them via the Sentinel API.