Rollback

Rollback is returning a rule to an earlier version after a change causes harm, such as a flood of alerts or a missed detection. In a code workflow it is a revert and a redeploy. In a console it is a restore from history. Both beat editing by hand under pressure.

What Rollback means here

Rollback needs a known good version and a fast deploy path. The pipeline supplies the second. Versioning supplies the first.

Ask whether rollback is a product feature or a git operation. Both work, and the answer sets who needs repo access.

Example of Rollback in Microsoft Sentinel documentation

In Sentinel the repository is the source of truth and rollback is a git revert rather than a product feature, while SentinelAudit records who changed which property from which value. learn.microsoft.com read 2026-11-04

Terms related to Rollback

• Rule versioning: Rule versioning keeps every revision of a rule so you can see what changed, who changed it and when.
• Pull request workflow: A pull request workflow is how a rule change is proposed, reviewed and approved before it ships.
• Rule lifecycle: Rule lifecycle is the set of states a rule moves through, from draft and test to production, scheduled for deprecation and retired.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.