IngestEvents Error in Microsoft Sentinel Training Lab Deployment

Oney, Matthew T 0 Reputation points
2023-07-14T14:34:59.3166667+00:00

I'm trying to install the Microsoft Sentinel Training Lab. I'm able to create the resource group, the log analytics workspace and Sentinel but when I try to install the Training Lab from the Content Hub it fails on 'ingestEvents' part...

I get -

 "message": "The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'."

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"DeploymentScriptOperationFailed","message":"This request is not authorized to perform this operation

User's image

Does anyone have any suggestions? It's much appreciated....

 

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,221 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Givary-MSFT 35,216 Reputation points Microsoft Employee
    2023-07-18T08:59:16.25+00:00

    @Oney, Matthew T Apologies for the delayed response, As I understand you are running into deployment issues while deploying "Microsoft Sentinel Training Lab" from the content hub.

    Tried deploying the same at my end, ran into similar issue, after reviewing the steps mentioned here - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Training/Azure-Sentinel-Training-Lab/Modules/Module-1-Setting-up-the-environment.md#exercise-1-the-azure-sentinel-workspace was able to deploy it successfully, would request you to review the same and try to redeploy again.

    If the issue still persists, let me know we can connect offline to troubleshoot further on the same.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.