Twelve Microsoft Sentinel detections for configuration drift and privilege escalation - the misconfigurations AzClean reports at rest, caught as they happen. This is deliberately not a threat-detection pack. Microsoft's built-in analytics are better at that than anything sold alongside them. These cover the gap: someone opening an NSG to the internet, flipping public blob access on, granting themselves Owner, adding a service principal secret, disabling a Conditional Access policy, or quietly deleting the diagnostic settings that would have recorded it. Every query has been validated. All twelve were parsed and semantically analysed with Microsoft's own KQL parser against a Sentinel-shaped schema, so table names, column names, functions and syntax are verified. 12 of 12 pass. And they prove themselves in your workspace. Sentinel accepts a scheduled rule whose query is invalid and it then never fires, with no warning. So the pack ships a validator that runs every query against your own workspace and reports, per detection, whether it parses, whether the tables it needs are present, and whether it returns rows now. Read-only, creates nothing. Three of the detections are about trusting your own telemetry: a connector that silently stopped reporting, an ingestion spike burning your cap, and a daily total sitting flat across days - which is a cap being hit and data being dropped, not a measurement. A deployment script creates the scheduled analytics rules from a manifest carrying severity, frequency, period and MITRE tactics, with -WhatIf, -Disabled and single-rule deployment. Five detections map to an AzClean at-rest check. PowerShell 5.1 or 7+. Lifetime updates.