Training Lab guide fails with error to deploy metadata

[javiersoriano]

Training Lab guide fails with error to deploy metadata

[v-sudkharat]

Hi @AttacktheSOC, Thank you for sharing your observation with us. We have tested the template with your suggested solution, and the deployment completed successfully : -

But, after deployment the solution does not show as installed in Content Hub, it may be due to the installation or sync not done correctly : -

We have reached out to our respective backend team for this issue, and once we receive any update from them will update you.
Thanks again for your contribution. Please let us know if have any questions or won't to share any update on this.

Thanks!

[AttacktheSOC]

Ahh so close, lol. Please let me know if I can help test anything, would be more than happy!

[v-sudkharat]

Hi @javiersoriano, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 03-04-2024. Thanks!

[v-sudkharat]

Hi @javiersoriano, we are reaching out to the concerned team for this issue, once we receive an update on this, we will update you.
Thanks!

[AttacktheSOC]

Hi @v-sudkharat I took a quick jab at it in my lab and pulled down the template.json after I received the same failure.

It looks like the parentId was expecting a fully qualified resource id. After some poking around I was able to deploy a custom template and it seems that the parentId, contentId and properties.source.sourceId all need to be changed from:

"[variables('_sourceId')]"

to:
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/metadata', variables('_sourceId')) ]"

Can confirm a full successful deployment after this change.

Hopefully this helps narrow things down for the team a bit.
Thanks!

• Dylan

[v-sudkharat]

@AttacktheSOC, Sure. Thanks!

[v-sudkharat]

Hey @javiersoriano/ @AttacktheSOC, The issue has been resolved by our concern team, please redeploy the solution and let us know of you still having issue. Thanks!
Sharing deployment screenshot: -

[javiersoriano]

It all works well now, Thanks!!