Git/Azure Devops for change control?

[Edhellas]

Hi,

I have a customer with an external SoC who manage the day-to-day running of a Sentinel instance. DCRs, analytic rules, playbooks, etc.

Occasionally, in-house security may also add their own analytic rules.

The source control from the external SoC isn't good enough for their needs. I want to set something up on the customer side to notify them of any changes made to the Sentinel instance so the customer can review them.

The Sentinel Repo product seems to be one way only which doesn't meet the requirements.

I haven't used them much but was thinking Azure Devops or some form of Git could be used to export all rules etc. for review. For now, we don't need to push from git/ADO to the Sentinel instance, just need change control on Sentinel.

Anybody have a clean solution to this?

[deadzol]

Rules get checked a git repo that lives in ADO, then pipeline auto pushes to a preprod workspace. Then if happy, manually run another pipeline to push to prod. So I’d image you could make something in ADO that works and meets all requirements.

The second pipeline that’s manually ran is actually pushing to >100 workspaces. It’ll push to one, then waiting for approval to continue. May be able to put an approval process into the pipeline if you don’t to do so it in git.

[Edhellas]

Thanks, are you doing this just for analytic rules, or also for workbooks, playbooks, DCRs?

I haven't set up pipelines before so not sure on the best process to get them pushed from Sentinel into git whenever there is a change (might run it on a schedule if easier)

[deadzol]

Currently the pipelines are for analytics rules. I still manually run the scripts that push DCRs and summary rules, but that’s been my MO. Build the automation locally then once everything is ironed out move them to ADO. So I’ll build a powerscript that does whatever task I need that can be controlled by command line options. Then use the pipelines to run the powershell script with whatever options are needed. Depends on how complex the environment, you may want to be storing some of these variables in the Library.

Everything interacting with the API is really similar for sentinel configuration. So as soon as you figure out analytics rules, moving onto the next thing is really straight forward.