Modernize Sentinel analytics rules repository

[leandroer]

Summary

Transforms the repository from a mixed portfolio bootstrap bundle into a focused Microsoft Sentinel detection-as-code project.

Repository structure

• promote analytics rules to a root-level, domain-based structure
• remove nested duplicate rules and unrelated profile, workbook, template, diagram, and bootstrap artifacts
• preserve removed content in Git history

Rule modernization

• rebuild the four original identity, Purview, AI security, and Agent 365 concepts
• replace placeholder GUIDs and broad queries
• add TimeGenerated, bounded aggregation, connector declarations, entity mappings, custom details, dynamic alert text, event grouping, incident grouping, suppression settings, and semantic versions
• add cloud, endpoint, and UEBA rule domains

Quality and validation

• add YAML, GUID, schedule, output-column, placeholder, and fixture validation
• add GitHub Actions validation
• add generated rule catalog with drift checking
• add KQL logic fixtures for password spray and prompt injection

Documentation

• add rule-authoring and layered validation guidance
• add custom AI telemetry schema contracts
• add coverage matrix, detection lifecycle, deployment guidance, changelog, contribution workflow, and MIT license

Validation

• python3 scripts/validate_rules.py
• python3 scripts/generate_catalog.py --check
• git diff --check

All checks pass locally. Seven analytics rules are included across seven domains.