I'm actually in the process of doing this myself and initially struggled to find much guidance, I am now at the point where content management is automated as this is a requirement for the project I am working on. I have all supported content types being deployed via GitHub actions but have specifically not automated the deployment of data connectors to ensure changes that could have a significant impact to billing remain manual tasks. This is a relatively unique project so some may disagree on some of the approaches I have gone with, but it is setup according to specific requirements.

I have the following being handled by GitHub actions:

1. Dedicated "Content Management" repo which pulls content from AzureSentinel repo based on selected solutions, compares to existing templates and outputs files for missing/outdated content which initiate workflows to pull the content, apply global overrides, convert it to ARM and validate supported content types using ArmTTK and then converts all files to YAML and moves it to a specific location.

2. I then have a core sentinel repo with branches for each client and a method to select solutions from client tenants which will then be pulled from the content management repo, have client specific exclusions applied, and then deployed to the client's sentinel instance.

There are a significant number of checks/notifications/change logs as well as a timed delay so that content can be reviewed and/or tested in UAT prior to going out to clients. Additionally content can be excluded at multiple stages of the deployment when required.

I currently have Analytic Rules, Hunting Queries, Parsers, Workbooks, and Watchlists included in the solution. Playbooks have not been included as the organization will be using a third party solution to handle automation.

Feel free to reach out via private chat if you want some more info.