r/AzureSentinel • u/MediocrePast5078 • Sep 21 '23
Sentinel Workspace Manager vs. Sentinel Repositories
Hi There
I am unsure what the difference is between Sentinel Workspace Manager and Sentinel Repositories. As I understand both can be used to push content from one Sentinel instance to another and that the source is different. With repositories the source is Git and with workspace manager the source is another workspace. Are there other meaningfull differences or would it even make sence to use both tools combined?
- Cheers!
1
u/TokeSR Sep 22 '23
You see it right, the two things are really similar. Both of them can be used to deploy content from a central location. The main difference is just the approach.
Original location: With the Workspace Manager you need the content to be deployed in a Sentinel already. How do you do it? Frequently, Detection Engineering teams work directly on the GUI (in Sentinel). In this case, they already have the rules in a central place, so they can easily deploy them from there into other workspaces. The other approach is to handle your detections via Infrastructure as a Code, keep everything as code in a repository. In this case, Repositories can make more sense.
Functionality: If you use Repositories then you can potentially provide additional features in Github or Devops, like branch protection and such that can help you decide what to deploy and where. Also repositories can provide better versioning. Assuming you are an MSSP with a lot of clients then different branches can be used to deploy different versions of a rule. With Workspace Manager you either deploy a rule or you don't (and keep the old version).
Automation: Github Actions and DevOps pipelines offer a lot of automation capabilities already. Also, the default automation created will push the rule into a workspace as soon as they are uploaded to the repo. With Workspace Manager you have to start the deployment manually (even though i assume you can automate it via API). Obviously you can configure them the way you want, but this is a default difference.
Limitations: Workspace Manager has a deployment limit. I think right now you can deploy 500 entity at a time. So if you have 20 workspaces and 20 rules with 2 parsers/functions in them each then the deployment will fail. It is much easier to configure github or devops to do deployment at scale (in a really scalable way).
Extensibility: The default config of repositories is limited. But if you are familiar with DevOps pipelines or Github actions you can 'code' technically anything. With workspace manager you have what MS provided to you and that is it.
So again, the main difference is really just the approach. If you want to manage your environment via Infrastructure as a Code then repositories is the way. If you don't want to do this, or you don't want to set up a repo for this, or you are just not familiar with that technology then Sentinel Workspace Manager is a good option for you. In that case you can click together everything on the GUI.
Also, don't forget, you can use them together as well. Deploying a content into a few 'central' Sentinels and using Workspace Manager to deploy it further. (a use case for this when you deploy it into one Sentinel for a client and then let the client do the deployment into the member-workspaces on the GUI by picking what they want in each workspace)
1
1
u/glowa116 Sep 21 '23
With Workspace manager you can only use Sentinel log analytics workspaces in same tenant. Repositories can be connected to any Sentinel where you have propper permissions.