Below you will find pages that utilize the taxonomy term “AzDO”
Microsoft Sentinel Infrastructure as Code - Automation Framework Overview
Project Overview
If you’ve ever found yourself manually clicking through the Azure portal to deploy resources, what starts as a simple “quick setup” quickly becomes hours of configuration, validation, and hoping you didn’t miss a critical setting. That’s exactly the problem I set out to solve with this Infrastructure as Code automation framework.
This project represents my journey to build a comprehensive solution for deploying and managing Microsoft Sentinel environments using Azure DevOps Pipelines. The goal was simple: make security operations scalable, repeatable and easy to update.
Microsoft Sentinel-as-Code
Version: 1.0.0
Author: Marcus Jacobson
License: MIT
Repository: GitHub
Project Status
- Foundation Infrastructure: COMPLETE
- Analytics Rules (NRT): COMPLETE
- Analytics Rules (Scheduled): COMPLETE
- Watchlist Automation: COMPLETE
- Hunting Queries: Planned
- Automation Rules: Planned
- Workbooks: Planned
- Data Connectors: Available via Content Hub
Project Goal
This project provides a comprehensive automation framework for deploying and managing Microsoft Sentinel environments using Azure DevOps Pipelines. The framework enables organizations to implement security operations at scale with consistency, repeatability, and governance through Infrastructure as Code (IaC) principles.
GitHub & AzDO - Sync an existing AzureDevOps Repository to GitHub
Version: 1.0.0
Author: Marcus Jacobson
License: MIT
Repository: GitHub
Project Goal
Create a one-way sync from Azure DevOps to GitHub, for the purpose of publishing projects created in Azure DevOps to the shareable GitHub repo.
Project Outcomes
Upon running the pipeline in AzureDevops, any new or changed files in the Azure DevOps repo will be updated in the GitHub repository.
Limitations:
- Due to the allowable permissions for GitHub personal access tokens, only read & write permissions are allowed, but delete permissions are not available. Therefore any deleted files in the Azure DevOps will not be deleted in GitHub.
- Any files that are moved within Azure DevOps will be duplicated, one version in each locations. Therefore any deleted or moved files will need to be manually remediated in GitHub.
- Another remediation option would be to empty the GitHub repository and then run the pipeline again in Azure DevOps. This will make sure that only the most recent files and folder structure is live in GitHub.
Features
There are three files that are included as part of this project:
Project Release - Sync an Azure DevOps repo to GitHub
Project Page: GitHub-Sync
Project Introduction
I work in Azure DevOps daily to deploy resources using Azure using pipelines. Therefore, I have a high familiarity with using Azure DevOps for deployments and build both personal and professional projects in the environment. However, I also want to be able to share my personal projects more widely using GitHub, since it is a more recognized tool for this purpose. I also want to consolidate all of my projects in one place (GitHub), regardless of whether they were built using Azure DevOps.