☁️ Azure Microsoft Sentinel Fusion Alert Rule Terraform Module

Enables Microsoft's multi-stage attack detection, which correlates low-fidelity signals from many sources into one high-confidence incident (azurerm_sentinel_alert_rule_fusion). Targets hashicorp/azurerm ~> 4.0.

• 🧩 Microsoft's multi-stage attack detection. Fusion correlates low-fidelity signals from many sources into a single high-confidence incident.
• ℹ️ You do not write the correlation logic — the template is the detection. This resource enables it and, optionally, narrows which source signals feed it.
• ⚠️ Every source_signals entry is a reduction in coverage. The module's default is to supply none.
• 🔴 name is deprecated and removed in provider v5.0, so this module neither accepts nor emits it — the one place in this family offering deliberately less than the pinned schema allows.
• ⚠️ The API version for this resource is a preview one.
• 🔁 enabled is the only argument that updates in place.
• 🔒 No credential is accepted and none is emitted.

💡 Why it matters: Fusion's value is precisely the breadth of what it correlates, which makes every tuning knob a way to make it worse. The module therefore defaults to no tuning at all, and emits the signals you turned off so the reduction is visible.

📅 Azure portal retirement - March 31, 2027

Microsoft states that after March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal, and that customers using Microsoft Sentinel in the Azure portal will be redirected to the Defender portal. Since July 2025 many new customers are onboarded and redirected to the Defender portal automatically.

This does not change what this module manages. azurerm_sentinel_* are ARM resources and Terraform talks to ARM, not to a portal, so these resources continue to exist and stay manageable from code across that date. What moves is the management experience - runbooks, screenshots, analyst training, and any procedure that ends in a human clicking through Sentinel in the Azure portal. Plan that transition on its own schedule; this module emits management_moves_to_the_defender_portal so the date reaches plan output and inventory reports rather than living only in documentation.

Reference: https://learn.microsoft.com/azure/sentinel/overview#microsoft-sentinel-in-the-azure-portal-retirement-timeline

If this module saves you time, please consider supporting its continued development:

• ⭐ Star the repository on GitHub.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart LR
  law["terraform-azurerm-log-analytics-workspace: Sentinel has no workspace of its own. Everything here lives on a Log Analytics workspace, and its RETENTION decides how far back any detection can look."]
  onboard["terraform-azurerm-sentinel-log-analytics-workspace-onboarding: THE GATE. Nothing else in this family works until it exists, and DESTROYING IT OFFBOARDS SENTINEL from the workspace."]
  wsid["AND WIRE log_analytics_workspace_id FROM THIS MODULE'S workspace_id OUTPUT, not from the workspace module's id. Both carry the same value, but reading it through here makes Terraform ORDER ONBOARDING FIRST. The provider's own examples chain it this way."]
  gotcha["NOTE THE FIELD NAME TRAP: azurerm_log_analytics_workspace exports BOTH id AND an attribute literally named workspace_id. Every module in this family wants the ARM RESOURCE ID, not the GUID. A bare GUID is rejected at plan time."]
  cmk["and customer_managed_key_enabled is PERMANENT FOR THE WORKSPACE: once onboarded with it true, the workspace cannot be onboarded again with it false. It is also force-new, so a plan that looks like an ordinary replacement can leave the workspace offboarded and unable to come back the way you asked."]
  sched["terraform-azurerm-sentinel-alert-rule-scheduled: THE WORKHORSE. Your KQL, on a schedule. query_period must be at least query_frequency or events between runs are never examined."]
  nrt["terraform-azurerm-sentinel-alert-rule-nrt: the same shape MINUS the schedule, evaluated continuously. event_grouping is REQUIRED here, entity mappings cap at 5 combined not 10, and alert_rule_template_version is force-new."]
  nrtq["BUT NRT RESTRICTS THE QUERY: joins, wide unions and long aggregations are the usual casualties, and NOTHING CHECKS THAT AT PLAN TIME. Build it in the analytics-rule wizard first; porting a scheduled rule's query straight in is the common way to get a rule that will not run."]
  ms["terraform-azurerm-sentinel-alert-rule-ms-security-incident: PROMOTES alerts another Microsoft product already raised. Detects nothing itself. product_filter takes LEGACY product names, so Microsoft Defender for Endpoint is REJECTED and Microsoft Defender Advanced Threat Protection is accepted."]
  fusion["terraform-azurerm-sentinel-alert-rule-fusion: Microsoft's MULTI-STAGE attack correlation. Its name argument is DEPRECATED and removed in provider v5.0, so this module neither accepts nor emits it."]
  mlba["terraform-azurerm-sentinel-alert-rule-machine-learning-behavior-analytics: Microsoft's behaviour model. Needs a LEARNING PERIOD, so early silence is not a misconfiguration."]
  ti["terraform-azurerm-sentinel-alert-rule-threat-intelligence: matches logs against threat-intelligence INDICATORS, and supplies none. With no indicator source it is a detection that CANNOT FIRE, and nothing about it looks wrong."]
  tmpl["these three are TEMPLATE-DRIVEN: the alert_rule_template_guid IS the detection, so repointing it is a different detection rather than a retune, and enabled is the only thing that updates in place"]
  anom["terraform-azurerm-sentinel-alert-rule-anomaly-built-in: TOGGLES a rule Microsoft ships. It creates nothing, so REMOVING THIS RESOURCE DISABLES THE RULE rather than releasing it."]
  dup["terraform-azurerm-sentinel-alert-rule-anomaly-duplicate: a TUNED COPY, because a built-in rule's thresholds are read-only. Anything you do not override is INHERITED from the built-in rule."]
  pair["so the usual shape is a PAIR, and it needs a decision the provider will not make: running the original AND a tuned duplicate in Production means the same detection active twice with two sets of thresholds"]
  mode["and BOTH anomaly modules take a REQUIRED mode: Production or FLIGHTING. Flighting runs in evaluation - enabled, configured, and not contributing. Right while tuning, wrong to leave behind."]
  gaps["THE FAMILY'S REAL RISK IS NOT AN OPEN DOOR, IT IS A SILENT DETECTION. enabled false, create_incident_enabled false, suppression_enabled true, mode Flighting, a trigger threshold above zero, a severity_filter missing High - each looks reasonable alone and each leaves a rule that passes a review asking IS IT CONFIGURED and fails one asking DOES IT WORK."]
  emit["which is why every module here emits derived posture flags - is_active, creates_incidents, is_production_mode - and the two query modules gather them into a single detection_gaps output"]

  law -->|"id"| onboard
  cmk -->|"decide before the first apply"| onboard
  onboard -->|"workspace_id"| wsid
  gotcha -->|"read this first"| wsid
  wsid -->|"log_analytics_workspace_id"| sched
  wsid -->|"log_analytics_workspace_id"| nrt
  wsid -->|"log_analytics_workspace_id"| ms
  wsid -->|"log_analytics_workspace_id"| fusion
  wsid -->|"log_analytics_workspace_id"| mlba
  wsid -->|"log_analytics_workspace_id"| ti
  wsid -->|"log_analytics_workspace_id"| anom
  wsid -->|"log_analytics_workspace_id"| dup
  nrtq -->|"unvalidatable"| nrt
  tmpl -->|"shape"| fusion
  tmpl -->|"shape"| mlba
  tmpl -->|"shape"| ti
  anom -->|"settings_definition_id becomes built_in_rule_id"| dup
  pair -->|"disable or flight the original"| dup
  mode -->|"required"| anom
  mode -->|"required"| dup
  gaps -->|"so"| emit
  emit -->|"assert on these"| sched
  emit -->|"assert on these"| nrt

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class onboard keystone;
  class sched,nrt,ms,fusion,mlba,ti,anom,dup me;
  class law,wsid,gotcha,cmk,nrtq,tmpl,pair,mode,gaps,emit sib;

flowchart TB
  what["FUSION IS MICROSOFT'S MULTI-STAGE ATTACK DETECTION. It correlates LOW-FIDELITY signals from many sources into a single high-confidence incident."]
  tmpl["you do not write the correlation logic - THE TEMPLATE IS THE DETECTION. This resource enables it and, optionally, narrows which source signals feed it. Repointing alert_rule_template_guid is a DIFFERENT DETECTION, not a retune."]
  narrow["SO TREAT EVERY source_signals ENTRY AS A REDUCTION IN COVERAGE unless it only restates a default. Setting a source's enabled to false, or trimming a sub-type's severities_allowed, REMOVES SIGNAL FROM THE CORRELATION - and the incidents you stop seeing are not logged anywhere as suppressed."]
  sev["severities_allowed is the field most likely to be set too narrowly. Fusion correlates WEAK signals, so excluding Low and Informational from a subtype can remove precisely the evidence the correlation needed."]
  empty["which is why the module's DEFAULT IS TO SUPPLY NO SOURCE TUNING AT ALL - the template's own configuration is the widest coverage - and why disabled_source_signal_names is emitted on its own"]
  dep["THE name ARGUMENT IS DEPRECATED AND REMOVED IN PROVIDER v5.0. The schema carries a deprecated flag, and merely READING the attribute back raises a deprecation warning at terraform validate."]
  gone["SO THIS MODULE NEITHER ACCEPTS NOR EMITS IT. A field that disappears at the next major version is a migration handed to every caller, and the service names the rule perfectly well without one. Import still works: the ARM name is part of the Resource ID either way."]
  less["this is the ONE PLACE IN THIS FAMILY where a module deliberately offers LESS than the pinned schema allows"]
  preview["and note the API version for this resource is a PREVIEW one, which is worth knowing before depending on its stability"]
  names["source and sub_type names come from the FUSION TEMPLATE, not a fixed list, and are left UNVALIDATED for that reason - the set grows as Microsoft adds detections, so an enum would eventually reject a valid current value"]
  silent["and the family risk applies: enabled false leaves the multi-stage detection present in the workspace and SILENT - the state that survives a review asking IS IT CONFIGURED while failing one asking IS IT WORKING"]
  this["terraform-azurerm-sentinel-alert-rule-fusion"]
  keystone["azurerm_sentinel_alert_rule_fusion.this"]

  what -->|"so"| tmpl
  tmpl -->|"therefore"| narrow
  narrow -->|"especially"| sev
  sev -->|"so"| empty
  empty -->|"posture"| this
  dep -->|"therefore"| gone
  gone -->|"note"| less
  less -->|"and"| preview
  preview -->|"typing"| this
  names -->|"validation"| this
  silent -->|"emitted as is_active"| this
  this -->|"enables the multi-stage correlation"| keystone

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class this me;
  class keystone keystone;
  class what,tmpl,narrow,sev,empty,dep,gone,less,preview,names,silent sib;

Resource inventory

Schema notes that bite — confirmed against the live provider schema and its documentation:

• 🔴 name is DEPRECATED on this resource and removed in provider v5.0. The schema carries the flag, and merely reading the attribute back raises a deprecation warning at terraform validate. This module neither accepts nor emits it.
• The ARM API version for this resource is a PREVIEW version at the time of authoring, which is worth knowing before depending on its stability.
• source and sub_type names come from the Fusion template, not from a fixed list.
• sub_type.severities_allowed is required and must be non-empty.
• Force-new: log_analytics_workspace_id, alert_rule_template_guid.
• enabled is the only argument that updates in place. Everything else is force-new.
• No tags. Tag the workspace.
• lifecycle is not valid inside a module block, so a caller cannot add ignore_changes or prevent_destroy.

Contributor or Owner at the same scope also work, and are broader than needed.

ℹ️ Sentinel's roles are workspace-scoped, and there is no per-rule permission — so a team that may enable this detection may also disable every other one.

• The Log Analytics workspace already onboarded to Microsoft Sentinel — wire log_analytics_workspace_id from that module's workspace_id output so Terraform orders the two correctly.
• The alert rule template present in the workspace's template gallery, and its GUID. Templates are supplied by Microsoft and by installed content solutions.
• The Fusion template in the workspace's gallery. There is normally one per workspace, so this is usually a single fixed GUID.
• Data flowing from the sources Fusion correlates. Its value comes from breadth: a Fusion rule in a workspace with one connector has very little to correlate.

terraform-azurerm-sentinel-alert-rule-fusion/
├── providers.tf   # required_version + the pinned azurerm provider. No provider block.
├── variables.tf   # log_analytics_workspace_id, alert_rule_template_guid,
#                  # enabled, source_signals, timeouts. NO name — deprecated.
├── main.tf        # the keystone, one resource
├── outputs.tf     # id first, then the template facts, then is_active
├── README.md      # this document
├── SCOPE.md       # the cross-module contract
├── LICENSE        # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "rule_fusion" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-sentinel-alert-rule-fusion.git?ref=v1.0.0"

  # ⚠️ From the ONBOARDING module, not the workspace module. See example 1.
  log_analytics_workspace_id = module.sentinel.workspace_id

  alert_rule_template_guid = "f71aba3d-28fb-450b-b192-4e76a83015c8"

  # source_signals deliberately omitted: the template's own configuration is the
  # widest coverage. See example 3.
}

ℹ️ The caller configures the provider, its authentication, and the mandatory features {} block. This module declares none of them.

⚠️ Read example 3 before adding any source_signals — every entry narrows the detection.

Consumes

Emits

No credential is accepted and none is emitted.

# ✅ This creates the dependency edge.
log_analytics_workspace_id = module.sentinel.workspace_id

# ⚠️ Identical string. No dependency on onboarding.
log_analytics_workspace_id = module.law.id

# ❌ Rejected at plan time.
log_analytics_workspace_id = azurerm_log_analytics_workspace.example.workspace_id

Error: Invalid value for variable

  log_analytics_workspace_id must be a Microsoft.OperationalInsights/workspaces
  ARM Resource ID of the form
  /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.OperationalInsights/workspaces/<name>.
  THE CHECK IS ANCHORED AT BOTH ENDS: nothing may be appended AND nothing may be
  prepended. The end anchor matters because this rule OWN ID extends the same path
  with /providers/Microsoft.SecurityInsights/alertRules/<name>. Prefer the Sentinel onboarding module's
  `workspace_id` output; a bare GUID is the workspace's customer ID and is not
  accepted.

alert_rule_template_guid = "f71aba3d-28fb-450b-b192-4e76a83015c8"

# ✅ The recommended state: no tuning at all.
# source_signals = []

# ⚠️ Each of these removes signal from the correlation.
source_signals = [
  {
    name    = "Alerts"
    enabled = true
    sub_type = [{
      name               = "MicrosoftDefenderForEndpoint"
      severities_allowed = ["High", "Medium"] # ⚠️ Low and Informational dropped
    }]
  },
  {
    name    = "Anomalies"
    enabled = false # 🔴 this whole source no longer feeds Fusion
  },
]

output "turned_off" { value = module.rule_fusion.disabled_source_signal_names }

The pinned provider's schema still accepts a `name` on this resource:

  name  |  deprecated = true

  "the `name` is deprecated and will be removed in v5.0 version of the provider."

This resource's ARM API version is a PREVIEW version.

enabled = true # the default

output "check" { value = module.rule_fusion.is_active } # expect true

Force-new: log_analytics_workspace_id  alert_rule_template_guid
Updatable: enabled

locals {
  fusion_templates = {
    # Normally one per workspace, so this is usually a single entry.
    default = "f71aba3d-28fb-450b-b192-4e76a83015c8"
  }
}

module "rule_fusion_all" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-sentinel-alert-rule-fusion.git?ref=v1.0.0"
  for_each = local.fusion_templates

  log_analytics_workspace_id = module.sentinel.workspace_id
  alert_rule_template_guid   = each.value
}

output "active" {
  value = { for k, m in module.rule_fusion_all : k => m.is_active }
}

output "rule_fusion_review" {
  value = {
    active   = module.rule_fusion.is_active            # the assertion
    template = module.rule_fusion.alert_rule_template_guid
    tuned    = module.rule_fusion.tunes_source_signals      # false is the wider posture
    disabled = module.rule_fusion.disabled_source_signal_names # 🔴 should be empty
  }
}

terraform import 'module.rule_fusion.azurerm_sentinel_alert_rule_fusion.this' \
  "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/law-sentinel-prod/providers/Microsoft.SecurityInsights/alertRules/f71aba3d-28fb-450b-b192-4e76a83015c8"

terraform destroy on THIS module:
  removes the alert rule  ->  the detection stops
                          ->  the TEMPLATE is untouched, and can be re-instantiated
                          ->  nothing else in the workspace is affected

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-sentinel-prod"
  location = "eastus"
}

module "law" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-log-analytics-workspace.git?ref=v1.0.0"

  name                = "law-sentinel-prod"
  resource_group_name = module.rg.name
  location            = module.rg.location
  sku                 = "PerGB2018"
  retention_in_days   = 90
}

# ── The gate ──────────────────────────────────────────────────
module "sentinel" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-sentinel-log-analytics-workspace-onboarding.git?ref=v1.0.0"

  workspace_id = module.law.id
}

# ── Fusion: no source tuning, which is the widest coverage (example 3) ───────
module "rule_fusion" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-sentinel-alert-rule-fusion.git?ref=v1.0.0"

  log_analytics_workspace_id = module.sentinel.workspace_id
  alert_rule_template_guid   = "f71aba3d-28fb-450b-b192-4e76a83015c8"

  # No source_signals: Fusion's value is the breadth of what it correlates.
  # No name: deprecated and removed in v5.0 (example 4).
}

# ── A rule we wrote ourselves, for contrast ────────────────────────────
module "rule_impossible_travel" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-sentinel-alert-rule-scheduled.git?ref=v1.0.0"

  name                       = "impossible-travel"
  log_analytics_workspace_id = module.sentinel.workspace_id

  display_name = "Impossible travel sign-in"
  severity     = "High"
  query        = file("${path.module}/queries/impossible_travel.kql")

  query_frequency = "PT15M"
  query_period    = "PT1H"

  tactics  = ["InitialAccess"]
  incident = { create_incident_enabled = true }
}

output "detection_posture" {
  value = {
    fusion_active   = module.rule_fusion.is_active                     # expect true
    fusion_narrowed = module.rule_fusion.tunes_source_signals          # expect false
    fusion_disabled = module.rule_fusion.disabled_source_signal_names  # expect []

    # And the rule we own outright.
    scheduled_gaps = module.rule_impossible_travel.detection_gaps
  }
}

There is no tags variable — the provider exposes none on Sentinel alert rules.

variable "source_signals" {
  type = list(object({
    name    = string
    enabled = optional(bool)
    sub_type = optional(list(object({
      name               = string
      enabled            = optional(bool)
      severities_allowed = list(string) # High | Medium | Low | Informational
    })), [])
  }))
  default = []
  # An ordered list, not a keyed map: the provider's blocks are positional and the signal names come
  # from the Fusion template rather than from the caller.
  validation {
    condition = alltrue(flatten([
      for s in var.source_signals : [for t in coalesce(s.sub_type, []) : length(t.severities_allowed) > 0]
    ]))
    error_message = "Every sub_type must allow at least one severity. An empty severities_allowed would silently remove that subtype's signal from the Fusion correlation."
  }
  # ...plus: non-empty names, no duplicate source names, and severities from the four legal values.
}

# DELIBERATELY NOT EXPOSED: `name`. Deprecated in the pinned schema and removed in v5.0; reading the
# attribute is enough to raise a validate warning. See example 4.

🔒 No credential is accepted and none is emitted.

• The deprecated name is removed from the module's surface rather than passed through. Reading it raises a validate warning, and it disappears in provider v5.0 — so exposing it would hand every caller a migration and a noisy validate. This is the one place in this family where a module deliberately offers less than the pinned schema allows, and it is what makes this module's v5.0 migration a non-event.

• source_signals defaults to empty, and the documentation frames every entry as a coverage reduction. For most resources an empty optional collection is simply a default; here it is the recommended state. Saying so is the difference between a caller tuning deliberately and tuning because the field exists.

• disabled_source_signal_names is emitted separately from the general list. It is the narrowest and most consequential thing this module can express — each entry is a class of evidence the multi-stage detection no longer sees, and folding it into a general list would have hidden it.

• The preview API version is disclosed rather than glossed. It explains why this resource's argument surface moves more than a stable one's, and the name deprecation is the visible evidence.

• enabled keeps the provider's true default, inverting this suite's usual convention. The rule "default to the closed value" assumes the closed value is the safe one; for a detection it is not. The convention is followed by understanding it rather than applying it mechanically — the same reasoning as every other rule module in this family.

• The module's surface is kept as small as the resource's. There is no synthetic input for anything the detection does, because none of it is configurable. Inventing knobs would misrepresent what the caller controls, and this suite would rather be honest about a four-argument resource than pad it.

• alert_rule_template_guid is force-new, and that is documented as semantically correct rather than as a limitation. The template is the detection, so repointing it is a different detection — a replacement is the accurate representation, not an inconvenience.

• Where a value set belongs to the service, it is left unvalidated and the reason is stated. Fusion source and sub-type names come from the template, and the set grows as Microsoft adds detections — so an enum here would eventually reject a valid current value.

• Before adding source_signals: the template's own configuration is the widest coverage.
• Before trimming severities_allowed: Fusion correlates weak signals, so Low may be the evidence.
• Before upgrading the provider: this resource is on a preview API, and name is already gone in v5.0.
• Before reporting Fusion as active: check how many data connectors it actually has to correlate.

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the source to a tag — ?ref=v1.0.0 — never a branch.
• Plan-only from here. A human applies from CI.
• ✅ enabled updates in place. Turning a detection on or off is an ordinary apply.
• ⚠️ Everything else is force-new, and replacing a rule resets its alert history in Sentinel.
• ℹ️ Assert is_active in CI. It is a single boolean and the only thing here that can be wrong in a way that matters.
• ℹ️ There is no name argument — deprecated in the pinned schema, removed in v5.0.
• ℹ️ A destroy removes the detection. Nothing else in the workspace is affected.

terraform validate and terraform fmt -check are the offline gate. They confirm:

• log_analytics_workspace_id is a Microsoft.OperationalInsights/workspaces ARM Resource ID — a bare GUID is rejected;
• alert_rule_template_guid is a GUID;
• every source_signals entry has a non-empty name, with no duplicate source names;
• every sub_type has a non-empty name and at least one allowed severity, drawn from the four legal values;
• no output is sensitive, because nothing sensitive is accepted;
• the module declares no provider block.

💡 These were proved by evaluating the conditions in terraform console inside the module — which does fire root-module variable validations, unlike terraform validate on a calling configuration. A bare GUID in the workspace field and a non-GUID template value both fail.

What only plan and apply exercise:

• whether the workspace exists and is onboarded to Sentinel;
• whether the template GUID names a template of the right kind, and whether it exists in this workspace;
• whether the identity holds Microsoft Sentinel Contributor.

What no Terraform command checks at any stage:

• whether enough data connectors exist for Fusion to correlate anything — its entire value is that breadth;
• whether a source or sub-type name is one the Fusion template recognises;
• which incidents a narrowed correlation is no longer producing — nothing reports it.

Outputs:

alert_rule_template_guid     = "f71aba3d-28fb-450b-b192-4e76a83015c8"
disabled_source_signal_names = []
enabled                      = true
id                           = "/subscriptions/00000000-.../providers/Microsoft.SecurityInsights/alertRules/f71aba3d-28fb-450b-b192-4e76a83015c8"
is_active                    = true
log_analytics_workspace_id   = "/subscriptions/00000000-.../workspaces/law-sentinel-prod"
source_signal_names          = []
tunes_source_signals         = false

✅ tunes_source_signals = false and disabled_source_signal_names = [] — the widest coverage, which is the recommended posture.

ℹ️ Note the absence of a name output. Deprecated in the pinned schema and removed in v5.0 (example 4).

⚠️ is_active = true says the rule fires. It does not say Fusion has enough sources to correlate.

• azurerm_sentinel_alert_rule_fusion — provider documentation.
• Advanced multistage attack detection (Fusion) — what Fusion correlates, and the source signals of example 3.
• Configure multistage attack detection — tuning source signals from the portal's side.
• Create custom analytics rules — how rule templates are instantiated in the service.
• Microsoft Sentinel roles and permissions — the RBAC table above.
• Sibling modules: terraform-azurerm-sentinel-log-analytics-workspace-onboarding, ...-alert-rule-scheduled, ...-alert-rule-nrt, ...-alert-rule-ms-security-incident, ...-alert-rule-fusion, ...-alert-rule-machine-learning-behavior-analytics, ...-alert-rule-threat-intelligence, ...-alert-rule-anomaly-built-in, ...-alert-rule-anomaly-duplicate.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."