> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Manage detection content as a versioned library, deploy it to the workspaces you run, and keep it from drifting.

The Content Management Center (CMC) is where detection content lives before it reaches a
customer. Rules are stored in **repositories**, versioned as they change, deployed to the
workspaces you choose, and continuously compared against what is actually running.

It replaces the pattern of editing rules directly in each Microsoft Sentinel or Microsoft
Defender XDR tenant, where the only record of a change is the change itself.

## What a repository gives you

<CardGroup cols={2}>
  <Card title="One source of truth" icon="book">
    A rule has one definition and a version history. Every workspace running it is
    running a known version, not a copy that someone edited in place.
  </Card>

  <Card title="Deployment you control" icon="rocket">
    Choose which workspaces a repository covers, deploy a rule to some or all of them,
    and roll back to an earlier version.
  </Card>

  <Card title="Drift detection" icon="radar">
    Scan a workspace and CMC reports the rules that no longer match the baseline, so an
    edit made in a vendor console does not stay invisible.
  </Card>

  <Card title="Review before change" icon="code-pull-request">
    Turn on protection and edits stop committing directly. They collect as work in
    progress, get bundled into a change request, and require approval.
  </Card>
</CardGroup>

## The one rule that shapes everything else

A repository's rule set is its **baseline**. Baseline protection is either on or off, and
that single setting changes how every change behaves.

<CardGroup cols={2}>
  <Card title="Require change requests off" icon="pen">
    A change hits the baseline immediately as a new version. Fast, and appropriate for a
    repository one person maintains.
  </Card>

  <Card title="Require change requests on" icon="shield-check">
    Additions, edits, removals, imports and marketplace pulls all become **work-in-progress**
    items instead. Nothing changes until one is added to a **change request**, approved, and
    merged.
  </Card>
</CardGroup>

Everything in [Change requests](/guides/content-management-center/change-requests) follows
from that. If you are wondering why your edit did not appear in the rule list, protection
is almost always the answer.

## Supported platforms

CMC manages two rule platforms, and a repository can hold both.

| Platform                  | Shown as               | Deployed to                                      |
| ------------------------- | ---------------------- | ------------------------------------------------ |
| `SentinelAnalytics`       | Microsoft Sentinel     | Sentinel analytics rules in the target workspace |
| `DefenderCustomDetection` | Microsoft Defender XDR | Defender XDR custom detection rules              |

Each rule carries its platform, and the platform decides how the rule is validated,
where its query runs, and which target it deploys to. See
[Sentinel and Defender](/guides/content-management-center/platforms).

## How the pieces fit

```
Marketplace ──┐
              ├──> Repository ──> Change request ──> Deploy ──> Workspace
Import  ──────┤     (rules,        (when                          │
Author  ──────┘      versions)      protected)                    │
                          ▲                                       │
                          └──────── Drift scan ────────────────────┘
```

Content enters a repository three ways: pulled from the
[Marketplace](/guides/content-management-center/marketplace), imported from a workspace
that already runs it, or authored from scratch. It leaves through a deployment. The drift
scan closes the loop by reading back what is really running.

## Where to start

<CardGroup cols={2}>
  <Card title="Create a repository" icon="folder-plus" href="/guides/content-management-center/repositories">
    Set one up, choose the workspaces it covers, and configure protection.
  </Card>

  <Card title="Add rules" icon="file-code" href="/guides/content-management-center/rules">
    Import from a workspace, pull from the marketplace, or write your own.
  </Card>

  <Card title="Track coverage and drift" icon="radar" href="/guides/content-management-center/workspace-coverage">
    See what each workspace is running and reconcile what does not match.
  </Card>

  <Card title="Review changes" icon="code-pull-request" href="/guides/content-management-center/change-requests">
    Work in progress, change requests, approvals, and merges.
  </Card>
</CardGroup>

## Permissions

Access is governed by three organizational content permissions.

| You can                                                                                               | Requires | Roles                                  |
| ----------------------------------------------------------------------------------------------------- | -------- | -------------------------------------- |
| Browse repositories, rules, and the marketplace                                                       | Read     | Every organization member              |
| Import, author, and edit rules; deploy; raise and merge change requests                               | Author   | Content Operator, Content Admin, Owner |
| Create and delete repositories; change baseline protection, covered workspaces, and Sentinel settings | Manage   | Content Admin, Owner                   |

The practical split: a **Content Operator** can change content, a **Content Admin** can
change the rules about how content is changed.