When running post-deployment:
https://github.com/BlueTeamLabs/sentinel-attack/wiki/Sysmon-Threat-Hunting-workbook---post-deployment-configuration
the ARM template prompts you for your workspace name.
However the template uses your workspace name to create a storage account, which only allows lower case letters.
So the template creation fails with the error:
blobstore is not a valid storage account name. Storage account name must be between 3 and 24 characters in length and use numbers and lower-case letters only.
Suggestion: Add a warning on the above link to enter your workspace name in lowercase letters.