Normalization and the Azure Sentinel Information Model (ASIM) ARM template deployment

[Jeff Walzer]

I am looking to deploy the The Azure Sentinel Information Model (ASIM) Authentication parsers ARM template from GitHub and was wondering what values Workspace Name and Location are to be defined as this is the first time I'm deploying an ARM template.

I have selected the subscription and resource group, but I'm not clear on what is being asked for Workspace Name and Location.

Thx

[#2]

When you click on Azure Sentinel in the Azure Portal -https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel you should be shown a list of workspaces. Name and location should be listed there for you.

[#3]

@m_zorich - I do see Workspace Name and Location listed, but I'm not sure exactly what values to use

[#4 · Accepted solution]

When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.

[#5]

That did the trick - what threw me off was "Workspace Name" as I wish it would've been "Log Analytics Workspace Name," for consistency sake, but thx for the help