A court IT team versions Sentinel analytics as code and tests them in a non-prod workspace first. What detection practice is that?
Select an answer to reveal the explanation.
Short Explanation
Court detections deserve the same pipeline as app code—version them, test in non-prod, then promote. You'll miss it if you're versioning playbooks for response or hunting queries for investigations, or if you're testing analytics in production where you'll flood clerks with live alerts. Detection-as-code for the win.
Full Explanation
Versioning Sentinel analytics as code and testing them in a non-prod workspace first is detection-as-code for municipal SIEM content. Court IT treats KQL rules, hunting queries, and analytics like application releases: stored in git, reviewed via PR, validated against non-production log shapes (filing systems, identity, endpoints), then promoted to production. That reduces false-positive floods during peak filing hours and creates an audit trail of who changed detections that guard judicial workloads.
Using detection-as-code practices that version municipal playbook response workflows in non-prod is response automation, not analytics detection: it versions SOAR playbooks that drive response actions, but does not version or validate the KQL analytics rules that create the detections. Using detection-as-code practices that pre-test municipal Sentinel analytics directly in production skips non-prod validation, so an untested rule ships straight to live alerting and can spam clerks' support channels with false positives. Using detection-as-code practices that version municipal Sentinel hunting queries in non-prod versions proactive threat-hunting content, not scheduled analytics detections: hunting queries support manual investigation, so they do not create the promoted alerting rules described in this question.
Exam caveat: Detection-as-code still needs runtime monitoring—promoted rules can degrade when parsers change or new tables arrive. Include content CI (syntax validation, optional query smoke tests) and a rollback path. Non-prod must receive representative (possibly anonymized) telemetry or the test is theater.
Operational check: Place analytics in a repo with PR review; deploy to a non-prod Sentinel workspace first; run test incidents or historical replays against court connectors; promote via pipeline; and verify production rule versions match the repo tag used for that release.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.