DevOps — GitHub Actions deployment pipeline for Sentinel workspace

[TFT444]

Overview

Add a GitHub Actions workflow that deploys KQL analytics rules and Logic App playbook ARM templates to a target Microsoft Sentinel workspace on merge to main.

Workflow steps

1. Trigger: push to main (path filter: detection-rules/**, playbooks/**)
2. Validate all KQL rules (python scripts/validate_kql.py)
3. Run pytest (pytest tests/ -v)
4. Authenticate to Azure using OIDC (federated credentials — no stored secrets)
5. Deploy ARM templates for analytics rules via Azure CLI
6. Deploy Logic App ARM templates
7. Post deployment summary as commit status

Secrets required (documented, not stored here)

• AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID (OIDC — no client secret needed)
• SENTINEL_WORKSPACE_ID, SENTINEL_RESOURCE_GROUP

Acceptance criteria

• Workflow file: .github/workflows/deploy-sentinel.yml
• Triggered only on changes to detection-rules/ or playbooks/
• KQL validation and pytest run before deploy
• Uses OIDC auth (no long-lived secrets)
• README section added documenting required Azure OIDC setup

Part of

Phase 2 DevOps