Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

Normalization and the Azure Sentinel Information Model (ASIM) ARM template deployment

Iron Contributor

I am looking to deploy the The Azure Sentinel Information Model (ASIM) Authentication parsers ARM template from GitHub and was wondering what values Workspace Name and Location are to be defined as this is the first time I'm deploying an ARM template.


I have selected the subscription and resource group, but I'm not clear on what is being asked for Workspace Name and Location.



4 Replies
When you click on Azure Sentinel in the Azure Portal - you should be shown a list of workspaces. Name and location should be listed there for you.

@m_zorich - I do see Workspace Name and Location listed, but I'm not sure exactly what values to use




best response confirmed by Jeff Walzer (Iron Contributor)
When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.
That did the trick - what threw me off was "Workspace Name" as I wish it would've been "Log Analytics Workspace Name," for consistency sake, but thx for the help