Forum Discussion
Solved
Normalization and the Azure Sentinel Information Model (ASIM) ARM template deployment
I am looking to deploy the The Azure Sentinel Information Model (ASIM) Authentication parsers ARM template from GitHub and was wondering what values Workspace Name and Location are to be defined as t...
- When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.
When you click on Azure Sentinel in the Azure Portal -https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel you should be shown a list of workspaces. Name and location should be listed there for you.
- When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.
- That did the trick - what threw me off was "Workspace Name" as I wish it would've been "Log Analytics Workspace Name," for consistency sake, but thx for the help