# Skill Starter -- Sentinel Architecture

## Purpose

Design and review greenfield Microsoft Sentinel implementations against
the current proposed baseline.

## Principles

-   Prefer supported Microsoft-native capabilities.
-   Prefer native connectors where practical.
-   Preserve native Microsoft schemas unless transformation has a
    documented benefit.
-   Use DCR transformations where appropriate.
-   Treat ASIM primarily as a normalization/query abstraction.
-   Prefer managed identities and least privilege.
-   Separate reusable implementation from customer parameters.
-   Identify licensing and permission dependencies.
-   Identify settings that cannot reliably be managed through IaC.
-   Do not promote proposed patterns to standards without
    evidence/review.

## Required Architecture Output

State the requirement, recommendation, alternatives, tradeoffs, customer
decision points, IaC support, validation method, and authoritative
references.

## IaC Rule

Generated Bicep must build and lint before being considered complete.
Never hard-code secrets, tenant IDs, subscription IDs, or customer
values in reusable modules.