A SIEM that Can Still Answer for Last Quarter
retention_in_days defaults to 30, against intrusions usually discovered months later - so the first question, when did this start, gets silence rather than an answer. daily_quota_gb is a trap both ways and has no safe default, so the module makes you choose. And onboarding Sentinel connects no data source at all.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "sentinel" {
source = "www.iac-bazaar.com/iac-bazaar/azure-sentinel/azure"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
azure-sentinel
A Sentinel workspace that can still answer questions about last quarter. Works
with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.
retention_in_days defaults to 30, and that is a logging default that became
a security control by accident. Intrusions are typically discovered months
after they begin. A SIEM that cannot look back past a month cannot answer the
first question anybody asks - "when did this start" - and the answer will not
be "we don't know", it will be silence, because the data is gone.
investigable_window_days is an output for exactly that reason.
daily_quota_gb is a trap in both directions, and there is no safe default.
Leave it unlimited and one misconfigured verbose source bills thousands over a
weekend. Set a cap and ingestion stops for the rest of the day once it is
reached - so the day something noisy is happening is precisely the day you stop
recording it. Both are defensible; neither is safe. This module refuses to
choose for you: you either set the cap and say so, or leave it off and say so.
That is the one place here where the friction is the point.
Onboarding Sentinel connects nothing. The onboarding resource turns Sentinel on for the workspace. It does not connect Entra ID sign-ins, Defender, Office, or a single firewall - those are separate resources. A workspace with Sentinel enabled and no connectors is a SIEM with no data, billed as a SIEM, and it reads as "SIEM: yes" in every compliance questionnaire. A precondition makes you state which situation you are in.
internet_query_enabled defaults to true, and query is the asymmetric one.
Ingestion from the internet is usually necessary, because agents and cloud
services send from outside your network. Query is different: the workspace is
where the evidence lives, and querying it is how an intruder learns what you can
see.
Uses local_authentication_enabled rather than local_authentication_disabled -
the provider marks the latter deprecated, and shipping a buyer a deprecated
attribute is a papercut they inherit.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage