npm package: @microsoft/sentinel-cli
Description: CLI for Microsoft Sentinel deployment
Latest version: 0.1.0

# Sentinel CLI

The **Sentinel CLI** is a command-line interface for Microsoft Sentinel that supports secure authentication and deployment workflows. It enables automation of Sentinel resource management using scripts and CI/CD pipelines.

## Installation

Install globally using npm:

```bash
npm install -g @microsoft/sentinel-cli
```

---

## CLI Usage

Basic syntax:

```bash
sentinel [command] [options]
```

View available commands:

```bash
sentinel --help
```

---

## Authentication Options

Authenticate using the `login` command with one of the supported methods:

### 1. Browser Authentication (Default)

```bash
sentinel login
```

Launches an interactive browser-based authentication using the authorization code flow. This is the default method when no authentication flag is provided.

---

### 2. Device Code

```bash
sentinel login --use-device-code
```

Authenticate interactively using the device code flow. Use this when you cannot open a browser directly on the machine running the CLI — you will be prompted to visit a URL and enter a code on any other browser-capable device.

---

### 3. Workload Identity

```bash
sentinel login --workload-identity
```

Authenticate using Workload Identity. Use this when running inside GitHub Actions, Azure DevOps Tasks, or other Azure-integrated environments that support workload identity federation.

---

### 4. Managed Identity (User-Assigned)

Authenticate using a user-assigned Managed Identity. Provide exactly one of the following identity selectors:

```bash
# Authenticate via Client ID
sentinel login --identity --client-id <client-id>

# Authenticate via Object ID
sentinel login --identity --object-id <object-id>

# Authenticate via Resource ID
sentinel login --identity --resource-id <resource-id>
```

Use this when running inside an Azure VM or other Azure resource with a user-assigned managed identity.

**Parameters:**

- `--client-id <clientId>`: User-assigned Managed Identity client ID
- `--object-id <objectId>`: User-assigned Managed Identity object ID
- `--resource-id <resourceId>`: User-assigned Managed Identity resource ID

---

#### Logout

Clear stored credentials and log out:

```bash
sentinel logout
```

#### Get Token

Get an access token for the current authentication:

```bash
# Get token using current authentication
sentinel token

# Get token using managed identity
sentinel token --client-id <client-id>
```

---

### Resource Management Commands

#### Publish Job

Publish a Sentinel notebook using a deployment config:

```bash
sentinel job publish <notebookPath> --config <packagePath> --region <azureRegion>
```

**Example:**

```bash
sentinel job publish ./notebooks/example.ipynb --config ./configs/jobConfig.yaml --region eastus2euap
```

**Parameters:**

- `<notebookPath>`: Path to the Jupyter notebook file (.ipynb)
- `--config, -c`: Path to job configuration file (JSON or YAML)
- `--region, -r`: Target Azure region (default: Global)

#### Create Zip

Create a deployment package from a manifest file:

```bash
sentinel package create-zip <manifestPath>
```

**Example:**

```bash
sentinel package create-zip ./manifest.json
```

**Parameters:**

- `<manifestPath>`: Path to the manifest file that describes the package contents

#### Validate

Validate a YAML configuration file against the schema:

```bash
sentinel validate --file <yamlPath>
```

**Example:**

```bash
sentinel validate --file ./configs/jobConfig.yaml
```

**Parameters:**

- `--file, -f`: Path to the YAML file to validate

---

## Permissions

Grant the appropriate **Azure RBAC** permissions following the [Sentinel onboarding][sentinelonboarding].

## Contributing

The project is released under the [MIT License][license].

## Data and Telemetry

The Microsoft Sentinel CLI does not collect usage data. Read our [privacy statement][microsoftprivacy] to learn more.

## Code of Conduct

This project has adopted the [Microsoft Open Source Code of Conduct][codeofconduct]. For more information, see the [FAQ][codeofconductfaq] or contact [opencode@microsoft.com][opencodeemail].

[license]: LICENSE
[codeofconduct]: https://opensource.microsoft.com/codeofconduct/
[codeofconductfaq]: https://opensource.microsoft.com/codeofconduct/faq/
[opencodeemail]: mailto:opencode@microsoft.com
[microsoftprivacy]: https://privacy.microsoft.com/privacystatement
[defaultazurecredential]: https://learn.microsoft.com/en-us/javascript/api/@azure/identity/defaultazurecredential
[sentinelonboarding]: https://learn.microsoft.com/en-us/microsoft-sentinel-onboard#microsoft-sentinel-prerequisites