Tech Community Live: Microsoft Security
Dec 03 2024, 07:00 AM - 11:30 AM (PST)
Microsoft Tech Community
SOLVED

Normalization and the Azure Sentinel Information Model (ASIM) ARM template deployment

Iron Contributor

I am looking to deploy the The Azure Sentinel Information Model (ASIM) Authentication parsers ARM template from GitHub and was wondering what values Workspace Name and Location are to be defined as this is the first time I'm deploying an ARM template.

 

I have selected the subscription and resource group, but I'm not clear on what is being asked for Workspace Name and Location.

 

Thx

4 Replies
When you click on Azure Sentinel in the Azure Portal -https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel you should be shown a list of workspaces. Name and location should be listed there for you.

@m_zorich - I do see Workspace Name and Location listed, but I'm not sure exactly what values to use

 

JeffWalzer_0-1634123388204.png

 

best response confirmed by Jeff Walzer (Iron Contributor)
Solution
When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.
That did the trick - what threw me off was "Workspace Name" as I wish it would've been "Log Analytics Workspace Name," for consistency sake, but thx for the help
1 best response

Accepted Solutions
best response confirmed by Jeff Walzer (Iron Contributor)
Solution
When you are in the Azure Sentinel portal, select "Settings" from the navigation pane on the left. In the new screen, select "Workspace settings". This will take you to the Log Analytics page and you will see all the information you need there. You can mouse over each value and there will be an icon that shows that will allow you to copy the value.

View solution in original post