Forum Discussion
Solved
Normalization and the Azure Sentinel Information Model (ASIM) ARM template deployment
I am looking to deploy the The Azure Sentinel Information Model (ASIM) Authentication parsers ARM template from GitHub and was wondering what values Workspace Name and Location are to be defined as this is the first time I'm deploying an ARM template.
I have selected the subscription and resource group, but I'm not clear on what is being asked for Workspace Name and Location.
Thx
- When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.
- When you click on Azure Sentinel in the Azure Portal -https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel you should be shown a list of workspaces. Name and location should be listed there for you.
- When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.
