> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sentinel and Defender

> How CMC handles Microsoft Sentinel analytics rules and Microsoft Defender XDR custom detections.

CMC manages two rule platforms. A repository can hold both, and each rule carries the
platform it targets.

| Platform                  | Shown as               | Target                                        |
| ------------------------- | ---------------------- | --------------------------------------------- |
| `SentinelAnalytics`       | Microsoft Sentinel     | Analytics rules in a Log Analytics workspace  |
| `DefenderCustomDetection` | Microsoft Defender XDR | Custom detection rules in the Defender tenant |

The platform is set when a rule is created or imported and determines how the rule is
validated, which schema its query is checked against, and where a deployment writes.

## Microsoft Sentinel

### Importing

Importing lists the analytics rules in the selected workspace and brings the ones you
choose into the repository.

### Deploying

Deployments write analytics rules into the target workspace. A repository can set a
**default target workspace** so deployments that do not name one have somewhere to go. See
[Sentinel settings](/guides/content-management-center/repositories#sentinel-settings).

### Testing queries

The rule editor can run a query against the workspace before you save, so schema and syntax
errors surface while you are still writing.

<Note>
  Sentinel rule writes are performed by the ContraForce application, not with your personal
  Azure credentials. Your own Azure RBAC on the workspace is not what authorizes the write,
  so a rule can deploy successfully even where you personally lack permission to edit it in
  the Azure portal.
</Note>

## Microsoft Defender XDR

### Consent

Defender access requires consent to be granted for the tenant before CMC can read or write
custom detections. Until it is, the Defender options prompt for consent rather than listing
rules.

### Managed tenants

Where you manage several Defender tenants, CMC lists the ones available to you so imports
and deployments target the right one.

### Importing

Importing lists the custom detection rules in the selected Defender tenant. The importable
list and the fields shown differ from Sentinel, because the two products model detections
differently.

### The hunting schema

Defender custom detections run advanced hunting queries. CMC exposes the hunting schema so
the editor can validate table and column references while you write, and the test-query
action runs the query against Defender before you save.

## Choosing a platform for a rule

The platform is not a preference, it follows the data. A rule that queries tables only
present in Defender advanced hunting must be a Defender custom detection; one that queries
Log Analytics tables must be a Sentinel analytics rule.

Where the same detection idea applies to both, it is two rules, one per platform, not one
rule with two targets. Tag them the same way so they stay findable together.

## Mixed repositories

A repository can hold both platforms, and the **Rules** tab can filter by platform. Whether
to split them is an organizational choice:

* **One repository, both platforms** suits a customer or customer group who run both, so
  their content lives in one place with one review process.
* **Separate repositories** suit teams where different people own Sentinel and Defender
  content, since protection settings and approvers are per repository.