Modernize Sentinel analytics rules repository

.github/workflows/content-validation.yml

@@ -0,0 +1,20 @@
+name: Analytics rule validation
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: "3.12"}
+      - run: python -m pip install --disable-pip-version-check -r requirements-dev.txt
+      - run: python scripts/validate_rules.py
+      - run: python scripts/generate_catalog.py --check

.gitignore

@@ -0,0 +1,4 @@
+__pycache__/
+*.pyc
+.DS_Store
+.venv/

CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## Unreleased — 2.0.0
+
+- Restructure the repository around root-level analytics rules.
+- Rebuild four starter rules with unique GUIDs, bounded queries, mappings, alert enrichment, and incident settings.
+- Add cloud, endpoint, and UEBA rule domains.
+- Add automated validation, generated catalog, schemas, fixtures, architecture, and deployment guidance.
+- Remove unrelated portfolio bootstrap, profile, workbook, and repository-template artifacts.

CONTRIBUTING.md

@@ -0,0 +1,16 @@
+# Contributing and Maintainer Workflow
+
+The repository is not currently accepting unsolicited contributions. This guide documents the maintainer's quality standard.
+
+Every rule must include a stable GUID, semantic version, required connectors, schedule, severity, MITRE mapping where applicable, `TimeGenerated` in the final result, mapped entities, visible custom details, alert grouping, incident configuration, false-positive guidance, and response guidance.
+
+## Workflow
+
+1. Develop and test the KQL in a non-production Sentinel workspace.
+2. Exercise positive, negative, and boundary cases.
+3. Add or update a self-contained fixture when practical.
+4. Run `python3 scripts/validate_rules.py`.
+5. Regenerate the catalog with `python3 scripts/generate_catalog.py`.
+6. Record schema assumptions and test evidence in the pull request.
+
+Increment the rule version when logic, tables, thresholds, mappings, schedule, or incident behavior changes. Never commit credentials, tenant identifiers, personal data, real incident evidence, or unredacted prompts and responses.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Leandro Rocha
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,74 +1,64 @@
-# GitHub Portfolio Security Engineering Bundle
+# Microsoft Sentinel Analytics Rules
 
-This bundle contains artifacts to improve and professionalize a cybersecurity GitHub portfolio focused on:
+A focused detection-as-code library for Microsoft Sentinel covering identity, endpoint, cloud, Microsoft Purview, AI security, Microsoft Agent 365, and UEBA.
 
-- Detection Engineering
-- Incident Response
-- Microsoft Sentinel
-- Microsoft Defender XDR
-- Microsoft Purview
-- Microsoft Agent 365
-- AI Security
-- SOAR / Logic Apps
-- KQL
-- Snort
-- Sigma
+Every rule is an adaptable example. Validate connector identifiers, table schemas, thresholds, entity mappings, grouping, and expected alert volume in a non-production workspace before enablement.
 
-## Included Artifacts
+## Architecture
 
-```text
-.
-├── profile-readme/
-│   └── leandroer/
-│       └── README.md
-├── repo-templates/
-│   ├── STANDARD-REPO-README.md
-│   ├── DETECTION-DOCUMENTATION-TEMPLATE.md
-│   └── PROJECT-ROADMAP.md
-├── diagrams/
-│   ├── ai-security-operations-architecture.md
-│   ├── sentinel-soar-architecture.md
-│   └── snort-detection-architecture.md
-├── Sentinel-Analytics-Rules/
-├── Sentinel-Workbooks/
-└── deployment/
-    └── DEPLOYMENT-COMMANDS.md
+```mermaid
+flowchart LR
+    T["Security telemetry"] --> K["KQL detection"]
+    K --> E["Entity and context enrichment"]
+    E --> A["Sentinel alert"]
+    A --> I["Incident grouping"]
+    I --> R["Investigation and response"]
+    R --> M["Precision and coverage measurement"]
+    M --> K
 ```
 
-## Recommended GitHub Profile Pins
-
-Pin these repositories in this order:
+## Rule domains
 
-1. `IncidentResponse`
-2. `AI-Security-Incident-Response-Lab`
-3. `KQL-Templates`
-4. `Snort-Detection-Engineering-Lab`
-5. `Sentinel-Analytics-Rules`
-6. `Sigma-Templates`
+| Domain | Example coverage |
+|---|---|
+| AI security | Repeated prompt-injection indicators |
+| Agent 365 | Risky or unauthorized agent tool use |
+| Identity | Password spraying |
+| Purview | AI activity correlated with mass file operations |
+| Cloud | Azure resource deletion |
+| Endpoint | Suspicious PowerShell execution |
+| UEBA | Privileged-identity anomaly |
 
-## Recommended GitHub Topics
+Browse the generated [rule catalog](docs/rule-catalog.md) for tables, severity, ATT&CK mappings, entities, and versions.
 
-Use lowercase topics only:
+## Repository structure
 
 ```text
-cybersecurity
-incident-response
-detection-engineering
-microsoft-sentinel
-defender-xdr
-microsoft-purview
-ai-security
-kql
-soc
-threat-hunting
-logic-apps
-snort
-sigma
-
-## Repository Notice
-
-This repository is maintained as a professional cybersecurity portfolio and research project focused on detection engineering, incident response, threat hunting, security automation, and AI security.
-Content is published for educational, technical, and professional reference purposes. This repository is not currently accepting community contributions, pull requests, issue submissions, or feature requests.
-All content is provided as-is and should be reviewed, tested, and validated before use in production environments.
-blue-team
+analytics-rules/        Scheduled rule YAML organized by domain
+docs/                   Authoring, architecture, schema, and validation guidance
+scripts/                Static validation and catalog generation
+tests/fixtures/          Self-contained KQL logic fixtures
+.github/workflows/      Pull-request validation
+```
+
+## Validate
+
+```bash
+python3 -m pip install -r requirements-dev.txt
+python3 scripts/validate_rules.py
+python3 scripts/generate_catalog.py --check
 ```
+
+Static validation does not prove that a rule compiles against tenant data. See [validation strategy](docs/validation-strategy.md) for workspace-backed testing requirements.
+
+See the [coverage matrix](docs/coverage-matrix.md) for current behavioral and telemetry coverage, and [deployment guidance](deployment/README.md) before attempting tenant deployment.
+
+## Validation labels
+
+- **Example** — structurally reviewed, but not executed against representative telemetry.
+- **Lab Tested** — executed with controlled positive and negative scenarios.
+- **Production Validated** — operated against representative production telemetry with documented results.
+
+## Notice
+
+This repository is a professional cybersecurity portfolio and defensive research project. Unsolicited community contributions, issue submissions, and feature requests are not currently accepted. Content is provided as-is and must be reviewed, tested, authorized, and tuned before production deployment.