Add Sentinel analytics rule ARM templates for all 13 retail detection rules

[TFT444]

Summary

Closes #69

Adds 13 Microsoft Sentinel analytics rule ARM templates under sentinel/analytics-rules/, one for each retail KQL detection rule. Each template is deployable via Azure CLI or the Sentinel UI Analytics import feature and embeds the full KQL query inline.

Files added

sentinel/analytics-rules/
├── README.md
├── after_hours_access.json          (T1078  — Medium)
├── ai_voice_fraud.json              (T1598  — High)
├── credential_stuffing.json         (T1110.004 — High)
├── data_exfiltration.json           (T1048  — Critical)
├── gift_card_fraud.json             (T1657  — High)
├── mfa_fatigue.json                 (T1621  — High)
├── phishing_detection.json          (T1566.001 — High)
├── pos_anomaly.json                 (T1056.001 — High)
├── pos_void_refund.json             (T1056.001 — High)
├── privileged_role_addition.json    (T1098/T1078 — High)
├── ransomware_indicator.json        (T1486  — Critical)
├── supplier_impossible_travel.json  (T1199/T1078 — Medium)
└── supply_chain_anomaly.json        (T1195  — High)

Template schema

Each ARM template uses Microsoft.OperationalInsights/workspaces/providers/alertRules (kind: Scheduled, API version 2022-11-01-preview) and includes:

• displayName, description, severity
• KQL query embedded inline (query field)
• queryFrequency and queryPeriod (PT5M / PT15M / PT30M depending on rule)
• tactics and techniques (MITRE ATT&CK)
• entityMappings (Account, Host, IP, Process, Mailbox as appropriate)
• customDetails: PlaybookTrigger, RiskScore, and a rule-specific field
• requiredDataConnectors referencing the RetailShield connector

---

How to test

1. Deploy a single rule to a dev Sentinel workspace:

   az deployment group create \
     --resource-group <rg> \
     --template-file sentinel/analytics-rules/phishing_detection.json \
     --parameters workspaceName=<workspace>

   Verify the rule appears under Sentinel → Analytics with the correct name, severity, frequency, and tactics.

2. Import via UI: Open Sentinel → Analytics → Import → select any .json from this directory. Confirm the rule preview shows the correct KQL and metadata before saving.

3. JSON schema validation: Run python -m json.tool sentinel/analytics-rules/phishing_detection.json (or any file) to confirm valid JSON.

4. Spot-check entity mappings: For mfa_fatigue.json, verify entityMappings contains Account (UserPrincipalName) and IP (IPAddress). For ransomware_indicator.json, verify Host (DeviceName) and Process (ProcessId, CommandLine).

5. Confirm all 13 rules are present and no KQL file was missed:

   ls sentinel/analytics-rules/*.json | wc -l   # should print 13

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
retail-shield	Ready	Preview, Comment	Jun 5, 2026 2:00pm