How to Deploy a Microsoft Sentinel workspace

This article covers the basics of creating a new Microsoft Sentinel workspace that can support SonicWall’s integration

Instructions

Deploying Microsoft Sentinel

1. Create a new resource.
   
2. Use the search field to find “Template deployment (deploy using custom templates)”. Click the Create button.
3. Select “Quickstart template”, and select the “quickstarts/microsoft.operationsmanagement/azure-sentinel” item from the drop-down menu. Click “Next”.
4. In this example, we’ll create a new resource group. Enter a name for your Sentinel workspace. Click “Review + create”, review the summary, and deploy the resource.
   

Accessing the Microsoft Sentinel workspace

1. On the Azure Portal home page, click Microsoft Sentinel, if available. If it isn’t shown, click the “More services” link to search for “sentinel”.
2. Click on your new Microsoft Sentinel workspace.
3. You are now in your new Microsoft Sentinel workspace.

Next Steps

• Install the SonicWall Network Security Solution via the Content Hub
• Deploy the Azure Monitor Agent (AMA) and Azure Arc Connected Machine Agent
• Configure SonicOS to forward ArcSight/CEF-formatted Syslog data to the Azure Monitor Agent
• Deploy the SonicWall ASIM parsers in your Sentinel workspace