Project page

GitHub - Sentinel-as-Code

Project Overview

If you’ve ever found yourself manually clicking through the Azure portal to deploy resources, what starts as a simple “quick setup” quickly becomes hours of configuration, validation, and hoping you didn’t miss a critical setting. That’s exactly the problem I set out to solve with this Infrastructure as Code automation framework.

This project represents my journey to build a comprehensive solution for deploying and managing Microsoft Sentinel environments using Azure DevOps Pipelines. The goal was simple: make security operations scalable, repeatable and easy to update.

Version: 1.0.0

Author: Marcus Jacobson

License: MIT

Repository: GitHub

Project Status

• Foundation Infrastructure: COMPLETE
• Analytics Rules (NRT): COMPLETE
• Analytics Rules (Scheduled): COMPLETE
• Watchlist Automation: COMPLETE
• Hunting Queries: Planned
• Automation Rules: Planned
• Workbooks: Planned
• Data Connectors: Available via Content Hub

Project Goal

This project provides a comprehensive automation framework for deploying and managing Microsoft Sentinel environments using Azure DevOps Pipelines. The framework enables organizations to implement security operations at scale with consistency, repeatability, and governance through Infrastructure as Code (IaC) principles.

Version: 1.0.0

Author: Marcus Jacobson

License: MIT

Repository: GitHub

Project Goal

Create a one-way sync from Azure DevOps to GitHub, for the purpose of publishing projects created in Azure DevOps to the shareable GitHub repo.

Project Outcomes

Upon running the pipeline in AzureDevops, any new or changed files in the Azure DevOps repo will be updated in the GitHub repository.

Limitations:

• Due to the allowable permissions for GitHub personal access tokens, only read & write permissions are allowed, but delete permissions are not available. Therefore any deleted files in the Azure DevOps will not be deleted in GitHub.
• Any files that are moved within Azure DevOps will be duplicated, one version in each locations. Therefore any deleted or moved files will need to be manually remediated in GitHub.
• Another remediation option would be to empty the GitHub repository and then run the pipeline again in Azure DevOps. This will make sure that only the most recent files and folder structure is live in GitHub.

Features

There are three files that are included as part of this project:

Project Page: GitHub-Sync

Project Introduction

I work in Azure DevOps daily to deploy resources using Azure using pipelines. Therefore, I have a high familiarity with using Azure DevOps for deployments and build both personal and professional projects in the environment. However, I also want to be able to share my personal projects more widely using GitHub, since it is a more recognized tool for this purpose. I also want to consolidate all of my projects in one place (GitHub), regardless of whether they were built using Azure DevOps.