# Step 4 -- First Bicep Baseline

## Goal

Prove the smallest useful deployment.

## First Resources

1.  Log Analytics workspace
2.  Sentinel onboarding
3.  Basic workspace settings
4.  Tags
5.  Useful outputs

## Layout

``` text
bicep/
├── main.bicep
└── modules/
    ├── log-analytics.bicep
    └── sentinel.bicep
examples/
└── example.bicepparam
```

## Rules

No hard-coded tenant/subscription IDs, secrets, or customer-specific
values in reusable modules.

## Build and Lint

``` bash
az bicep build --file bicep/main.bicep
az bicep lint --file bicep/main.bicep
```

Linting checks code quality and known problematic patterns without
deploying. Build asks whether it compiles; lint asks whether it violates
known guidance.

## Expansion Order

Retention → DCR/DCE → connectors → analytics → automation → playbooks →
workbooks → ASIM/custom parsing where justified.

## Decisions

Resource-group vs subscription scope, existing vs new workspace support,
retention defaults, tags, naming, and conditional resources.