Monitor across government. Keep agency control.
A whole-of-government Microsoft Sentinel design combining central investigation with agency-owned security data and workspaces.
Tasmanian GovernmentThe constraint
Digital Shared Services needed a security monitoring model that could extend across separate government tenancies. Analysts needed visibility of incidents and supporting events, while agencies needed control over their data and local response. Onboarding, permissions and running costs also needed a consistent approach.
Our design work
For Tasmania’s whole-of-government Sentinel pilot, Quokka’s specialist design work defined how a central cyber team could investigate across agencies while each agency retained its own security data, workspace and response capability.
The design
Define the managing and agency roles
Design a central managing tenancy with Azure Lighthouse delegation into agency Sentinel workspaces. Specify the permissions needed to query events, investigate incidents and manage detection content.
Make agency onboarding repeatable
Use Azure DevOps repositories, templates and pipelines to define agency onboarding and common Sentinel content. Establish a baseline for connectors, analytics, workbooks and supporting collection services.
Connect monitoring to operating costs
Document cloud and on-premises collection, event filtering and retention. Include usage workbooks and cost modelling so the team can assess how each source contributes to the service and its expenditure.
The design output
The final design set out the “Sentinel of Sentinels” architecture for the pilot, supported by requirements and an analytics-rule register. It gave the programme a defined model for central investigation, agency onboarding, data ownership and cost management.
Specialist design by Quokka Advisory’s Noel Kelly through Data#3 for Tasmanian Government Digital Shared Services. Scope shown: the whole-of-government Sentinel pilot design.
The engineering decisions.
The whole-of-government design covers delegated investigation, repeatable agency onboarding and the collection choices that determine running cost.
Keep agency data and detection in the agency
Each agency retains its own Sentinel and Log Analytics workspace, with detection logic and response capability in that tenancy. Azure Lighthouse gives the central team delegated query and incident-investigation access. Cross-workspace queries support shared investigation while the source logs remain in the agency workspace.
Define permissions for central and agency teams
The design separates managing-tenancy roles from the access delegated by each agency. It covers incident visibility, event queries and management of detection content, with connector activation accounting for the permissions and licences needed within the agency. That makes onboarding an explicit access decision as well as a technical deployment.
Deploy a common baseline through version control
Azure DevOps repositories, templates and pipelines define workspace setup, Lighthouse delegation and common Sentinel content. The baseline includes analytics rules, hunting queries, workbooks and playbooks, with an analytics register to support implementation. Agency onboarding can follow the same defined deployment process.
Control collection, retention and cost together
The collection design combines Microsoft cloud connectors with Windows Event Forwarding and Linux syslog or CEF collectors. Data collection rules define filtering and destinations; retention is considered by data type. Usage and expenditure workbooks help the operating team assess ingestion, retention and the cost of extending the baseline.
More of our work
All project storiesBuild cloud security into a connected environment.
Infrastructure as Code, cloud security and a successful migration, with Telstra Cloud Connect linking the wider network.
Fire Rescue VictoriaBuild certificate trust into OT access.
Certificate services for OT wireless authentication, internal service communications and network management access.
Greater Western WaterWhat needs to work better?
Talk to us about the environment, the constraint and the change.