# Sentinel Greenfield IaC -- Master Plan

## Purpose

Build a practical, reusable Microsoft Sentinel greenfield baseline
without prematurely building a full MSSP deployment platform.

## Starting Model

1.  **Bicep** --- desired Azure/Sentinel baseline.
2.  **GitHub** --- source control, review, and releases.
3.  **PowerShell** --- discovery, validation, testing, and helper
    automation.
4.  **Confluence** --- operational and architecture documentation.
5.  **Claude** --- pair programmer, reviewer, researcher, and
    documentation assistant.

## Recommended Order

-   Step 1 --- tooling
-   Step 2 --- repository
-   Step 3 --- architecture decisions
-   Step 4 --- first Bicep baseline
-   Step 5 --- PowerShell validation
-   Step 6 --- Confluence documentation
-   Step 7 --- Claude skills
-   Step 8 --- CI validation
-   Step 9 --- customer handoff
-   Step 10 --- Sentinel content-as-code
-   Step 11 --- snapshots/drift
-   Step 12 --- multi-customer delivery

## First Definition of Done

A repository can deploy a Log Analytics workspace, onboard Sentinel,
apply documented baseline settings, accept parameters, build/lint,
validate the result, and produce useful documentation.

## Do Not Solve Yet

Do not initially build direct multi-customer deployment,
repo-per-customer architecture, a private Bicep registry, automatic
drift remediation, or every possible customer exception.

## Suggested Repository

``` text
sentinel-platform/
├── .claude/skills/
├── .github/workflows/
├── bicep/modules/
├── config/
├── docs/
├── examples/
├── scripts/
└── tests/
```

## Core Rules

-   Parameterize customer/environment values.
-   Never store secrets in Git.
-   Prefer managed identities/workload federation.
-   Prefer native Microsoft connectors where practical.
-   Preserve native schemas unless transformation has a documented
    reason.
-   Record why defaults were selected.
-   AI-generated IaC must build, lint, and be reviewed.
-   Explicitly document manual/portal-only steps.

## First Sprint

Create the repo, verify tools, deploy a workspace + Sentinel with Bicep,
add prerequisite/deployment validation scripts, add build/lint CI,
create the first Confluence page, and add the first two Claude skills.