# Step 10 -- Sentinel Content-as-Code (Later)

## Goal

Evaluate Microsoft's native Sentinel repository integration only after
the baseline IaC is stable.

## Potential Scope

Analytics rules, automation rules, hunting queries, parsers, playbooks,
workbooks, and other content supported by the current Microsoft feature
set.

## Why Later

This introduces a second deployment path. Do not mix it into the first
Bicep proof-of-concept.

## Questions

-   Which content should Bicep deploy?
-   Which content should native Sentinel repository sync own?
-   How are portal changes handled?
-   Does customer GitHub policy allow the integration?
-   How does this work for customers that deploy manually?
-   Does this simplify or complicate the customer model?

## Rule

A resource/content type should have one clearly documented authoritative
deployment path.