Detection Engineering: Practicing Detection-as-Code – Tuning – Part 8

This post outlines a Detection-as-Code approach to streamline tuning of Microsoft Sentinel detections using Watchlists and CI/CD automation. It details organizing content-specific and global watchlists, leveraging KQL to contextualize pull requests by measuring potential alert/incident impact, and employing Azure DevOps pipelines and scripts to safely synchronize watchlist changes without ingestion gaps. The result is reduced alert noise, consistent filters across use cases, and scalable, controlled deployment of detection tuning.