The platform is set when a rule is created or imported and determines how the rule is
validated, which schema its query is checked against, and where a deployment writes.
Microsoft Sentinel
Importing
Importing lists the analytics rules in the selected workspace and brings the ones you choose into the repository.Deploying
Deployments write analytics rules into the target workspace. A repository can set a default target workspace so deployments that do not name one have somewhere to go. See Sentinel settings.Testing queries
The rule editor can run a query against the workspace before you save, so schema and syntax errors surface while you are still writing.Sentinel rule writes are performed by the ContraForce application, not with your personal
Azure credentials. Your own Azure RBAC on the workspace is not what authorizes the write,
so a rule can deploy successfully even where you personally lack permission to edit it in
the Azure portal.
Microsoft Defender XDR
Consent
Defender access requires consent to be granted for the tenant before CMC can read or write custom detections. Until it is, the Defender options prompt for consent rather than listing rules.Managed tenants
Where you manage several Defender tenants, CMC lists the ones available to you so imports and deployments target the right one.Importing
Importing lists the custom detection rules in the selected Defender tenant. The importable list and the fields shown differ from Sentinel, because the two products model detections differently.The hunting schema
Defender custom detections run advanced hunting queries. CMC exposes the hunting schema so the editor can validate table and column references while you write, and the test-query action runs the query against Defender before you save.Choosing a platform for a rule
The platform is not a preference, it follows the data. A rule that queries tables only present in Defender advanced hunting must be a Defender custom detection; one that queries Log Analytics tables must be a Sentinel analytics rule. Where the same detection idea applies to both, it is two rules, one per platform, not one rule with two targets. Tag them the same way so they stay findable together.Mixed repositories
A repository can hold both platforms, and the Rules tab can filter by platform. Whether to split them is an organizational choice:- One repository, both platforms suits a customer or customer group who run both, so their content lives in one place with one review process.
- Separate repositories suit teams where different people own Sentinel and Defender content, since protection settings and approvers are per repository.