1
Manage a security operations environment
easy
You are deploying an ARM template to create a saved search in a Log Analytics workspace. The template fails with an error that the resource type is not valid for Microsoft Sentinel. What is the most likely reason?
Exhibit
Refer to the exhibit.
```json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
"apiVersion": "2021-06-01",
"name": "[concat(parameters('workspaceName'), '/MyRule')]",
"properties": {
"displayName": "My Rule",
"category": "Security",
"query": "SecurityEvent | where EventID == 4625",
"tags": []
}
}
]
}
```