List of Microsoft Sentinel Advanced Security Information Model (ASIM) parsers

Advanced Security Information Model (ASIM) parsers normalize security event data from different sources. The following tables list source-specific filtering parsers from the Microsoft Sentinel GitHub repository. Select a source name to view its query-time parser definition. The Query Time Parser column uses the EquivalentBuiltInParser name specified in that definition.

For an overview of ASIM parsers, see the parsers overview. To understand how parsers fit within the ASIM architecture, see the ASIM architecture diagram.

The Uses pack parameter column indicates whether the filtering parser accepts the pack parameter. When supported, set pack=true to retain unmapped source fields in AdditionalFields.

The Ingest Time Parser column links Yes to the matching ingestion-time parser definition, or is empty if the repository doesn't contain one. Native normalized tables don't require an ingestion-time normalization parser.

Agent Event parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Agent Event Logs Any event normalized at ingestion to the ASimAgentEventLogs table. _Im_AgentEvent_Native true
Anthropic Claude Compliance Anthropic Claude Compliance events collected using the Codeless Connector Framework by BlueVoyant. _Im_AgentEvent_AnthropicClaudeCompliance true

Alert Event parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Alert Event Logs Any event normalized at ingestion to the ASimAlertEventLogs table. _Im_AlertEvent_Native true
AWS GuardDuty AWS GuardDuty findings. _Im_AlertEvent_AWSGuardDuty Yes true
Bitdefender GravityZone Bitdefender GravityZone alerts. _Im_AlertEvent_BitdefenderGravityZone true
Cisco Secure Endpoint Cisco Secure Endpoint alerts. _Im_AlertEvent_CiscoSecureEndpoint true
CrowdStrike Falcon CrowdStrike Falcon alerts. _Im_AlertEvent_CrowdStrikeFalcon Yes true
Google Cloud Security Command Center Google Cloud Security Command Center findings. _Im_AlertEvent_GoogleCloudSCC true
Google SecOps Google SecOps detection alerts. _Im_AlertEvent_GoogleSecOps true
Google Threat Intelligence Google Threat Intelligence alerts. _Im_AlertEvent_GoogleThreatIntelligence true
Microsoft Defender XDR Microsoft Defender XDR alert events (in the AlertEvidence table). _Im_AlertEvent_MicrosoftDefenderXDR false
Netskope Security Cloud Netskope Security Cloud alerts. _Im_AlertEvent_NetskopeSecurityCloud true
Palo Alto Cortex XDR Palo Alto Cortex XDR alerts. _Im_AlertEvent_PaloAltoXDR true
Salesforce Real-Time Event Monitoring Salesforce Real-Time Event Monitoring alerts. _Im_AlertEvent_SalesforceRealTimeEventMonitoring true
SentinelOne Singularity SentinelOne Singularity threat events (in the SentinelOne_CL table). _Im_AlertEvent_SentinelOneSingularity false
SentinelOne Singularity (CCF) SentinelOne Singularity alerts collected using the Codeless Connector Framework. _Im_AlertEvent_SentinelOneSingularityAlerts true
Wiz Cloud Wiz Cloud issues in the WizIssuesV3_CL table. _Im_AlertEvent_WizCloud true
Wiz Defend Wiz Defend detections in the WizDetectionsV3_CL table. _Im_AlertEvent_WizDefend true

Asset Entity parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Asset Entity Logs Any event normalized at ingestion to the ASimAssetEntityLogs table. _Im_AssetEntity_Native true

Audit Event parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Audit Event Logs Any event normalized at ingestion to the ASimAuditEventLogs table. _Im_AuditEvent_Native false
Alibaba Cloud ActionTrail Alibaba Cloud ActionTrail audit events. _Im_AuditEvent_AlibabaCloudActionTrail true
AWS CloudTrail AWS CloudTrail audit events. _Im_AuditEvent_AWSCloudTrail true
AWS CloudTrail (EC2 account and infrastructure) Amazon EC2 account and infrastructure audit events. _Im_AuditEvent_AWSCloudTrailEC2AccountAndInfrastructure Yes true
AWS CloudTrail (EC2 capacity and reservations) Amazon EC2 capacity and reservation audit events. _Im_AuditEvent_AWSCloudTrailEC2CapacityAndReservations Yes true
AWS CloudTrail (EC2 EBS) Amazon Elastic Block Store audit events. _Im_AuditEvent_AWSCloudTrailEC2EBS Yes true
AWS CloudTrail (EC2 Fleet and Spot) Amazon EC2 Fleet and Spot audit events. _Im_AuditEvent_AWSCloudTrailEC2FleetAndSpot Yes true
AWS CloudTrail (EC2 images and import/export) Amazon EC2 image and import/export audit events. _Im_AuditEvent_AWSCloudTrailEC2ImagesAndImportExport Yes true
AWS CloudTrail (EC2 instances) Amazon EC2 instance audit events. _Im_AuditEvent_AWSCloudTrailEC2Instances Yes true
AWS CloudTrail (EC2 interfaces and addresses) Amazon EC2 network interface and address audit events. _Im_AuditEvent_AWSCloudTrailEC2InterfacesAndAddresses Yes true
AWS CloudTrail (EC2 IPAM routing) Amazon VPC IP Address Manager routing and Resource Public Key Infrastructure (RPKI) audit events. _Im_AuditEvent_AWSCloudTrailEC2IPAMRouting Yes true
AWS CloudTrail (EC2 IPAM) Amazon VPC IP Address Manager audit events. _Im_AuditEvent_AWSCloudTrailEC2IPAM Yes true
AWS CloudTrail (EC2 launch and access) Amazon EC2 launch and access audit events. _Im_AuditEvent_AWSCloudTrailEC2LaunchAndAccess Yes true
AWS CloudTrail (EC2 private connectivity) Amazon EC2 private connectivity audit events. _Im_AuditEvent_AWSCloudTrailEC2PrivateConnectivity Yes true
AWS CloudTrail (EC2 security and observability) Amazon EC2 security and observability audit events. _Im_AuditEvent_AWSCloudTrailEC2SecurityAndObservability Yes true
AWS CloudTrail (EC2 Transit Gateway routing) AWS Transit Gateway routing audit events. _Im_AuditEvent_AWSCloudTrailEC2TransitGatewayRouting Yes true
AWS CloudTrail (EC2 Transit Gateway) AWS Transit Gateway audit events. _Im_AuditEvent_AWSCloudTrailEC2TransitGateway Yes true
AWS CloudTrail (EC2 Verified Access) AWS Verified Access audit events. _Im_AuditEvent_AWSCloudTrailEC2VerifiedAccess Yes true
AWS CloudTrail (EC2 VPC core and routing) Amazon VPC core and routing audit events. _Im_AuditEvent_AWSCloudTrailEC2VPCCoreAndRouting Yes true
Azure Activity Azure Activity events (in the AzureActivity table) in the category Administrative. _Im_AuditEvent_AzureActivity false
Azure Key Vault Azure Key Vault audit events. _Im_AuditEvent_AzureKeyVault false
Barracuda CEF Barracuda events collected using CEF. _Im_AuditEvent_BarracudaCEF false
Barracuda WAF Barracuda WAF events. _Im_AuditEvent_BarracudaWAF false
Cisco ISE Cisco ISE events. _Im_AuditEvent_CiscoISE false
Cisco Meraki Cisco Meraki events collected using the API connector or Syslog. _Im_AuditEvent_CiscoMeraki false
Cisco Meraki (Syslog) Cisco Meraki events collected to the table Syslog. _Im_AuditEvent_CiscoMerakiSyslog false
CrowdStrike Falcon CrowdStrike Falcon Host events. _Im_AuditEvent_CrowdStrikeFalconHost false
CrowdStrike Falcon Data Replicator CrowdStrike Falcon Data Replicator audit events. _Im_AuditEvent_CrowdStrikeFalconDataReplicator Yes true
Illumio SaaS Core Illumio SaaS Core events. _Im_AuditEvent_IllumioSaaSCore false
Infoblox BloxOne Infoblox BloxOne events. _Im_AuditEvent_InfobloxBloxOne false
Microsoft Events Windows Audit events collected in the Event table _Im_AuditEvent_MicrosoftEvent false
Microsoft Exchange 365 Exchange Administrative events collected using the Office 365 connector (in the OfficeActivity table). _Im_AuditEvent_MicrosoftExchangeAdmin365 false
Microsoft Security Events Windows Event 1102 collected using Azure Monitor Agent (using the SecurityEvent tables). _Im_AuditEvent_MicrosoftSecurityEvents false
Microsoft Windows Events Windows Event 1102 collected using Azure Monitor Agent (using the WindowsEvent tables). _Im_AuditEvent_MicrosoftWindowsEvents false
Oracle Cloud Infrastructure Oracle Cloud Infrastructure audit logs. _Im_AuditEvent_OracleOCI true
Salesforce Audit Trail Salesforce setup audit trail events. _Im_AuditEvent_SalesforceAuditTrail Yes (V2 table) true
Salesforce Real-Time Event Monitoring Salesforce Real-Time Event Monitoring audit events. _Im_AuditEvent_SalesforceRealTimeEventMonitoring true
SentinelOne SentinelOne events. _Im_AuditEvent_SentinelOne false
SQL security audit SQL security audit logs. _Im_AuditEvent_SQLSecurityAudit true
Vectra XDR Vectra XDR audit events. _Im_AuditEvent_VectraXDRAudit false
VMware Carbon Black Cloud VMware Carbon Black Cloud events. _Im_AuditEvent_VMwareCarbonBlackCloud false

Authentication parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Authentication Logs Any event normalized at ingestion to the ASimAuthenticationEventLogs table. _Im_Authentication_Native false
Alibaba Cloud ActionTrail Alibaba Cloud ActionTrail authentication events. _Im_Authentication_AlibabaCloudActionTrail true
Aruba Networks ClearPass Aruba Networks ClearPass authentication events. _Im_Authentication_ArubaNetworksClearPass true
Auth0 Auth0 authentication events. _Im_Authentication_OktaAuth0 true
AWS CloudTrail AWS sign-ins, collected using the AWS CloudTrail connector. _Im_Authentication_AWSCloudTrail Yes false
Barracuda WAF Barracuda WAF events. _Im_Authentication_BarracudaWAF false
Cisco ASA Cisco ASA events collected using CEF. _Im_Authentication_CiscoASA false
Cisco DNA Center Cisco DNA Center authentication events collected using Syslog. _Im_Authentication_CiscoDNAC false
Cisco FTD Cisco Firepower Threat Defense authentication events collected using Syslog. _Im_Authentication_CiscoFTD false
Cisco IOS Cisco IOS authentication events collected using Syslog. _Im_Authentication_CiscoIOS false
Cisco ISE Cisco ISE events. _Im_Authentication_CiscoISE false
Cisco ISE (administrator) Cisco ISE administrator authentication events. _Im_Authentication_CiscoISEAdministrator true
Cisco Meraki Cisco Meraki events collected using the API connector or Syslog. _Im_Authentication_CiscoMeraki false
Cisco Meraki (Syslog) Cisco Meraki events collected to the table Syslog. _Im_Authentication_CiscoMerakiSyslog false
CrowdStrike Falcon CrowdStrike Falcon Host events. _Im_Authentication_CrowdStrikeFalconHost false
CrowdStrike Falcon Data Replicator CrowdStrike Falcon Data Replicator authentication events. _Im_Authentication_CrowdStrikeFalconDataReplicator Yes true
CyberArk Audit CyberArk audit authentication events. _Im_Authentication_CyberArkAudit true
Fortinet Fortigate Fortinet Fortigate system admin logs. _Im_Authentication_FortinetFortigate Yes false
Google Workspace Google Workspace sign-ins. _Im_Authentication_GoogleWorkspace false
Google Workspace (CCF) Google Workspace login activities in the GoogleWorkspaceReports table, collected using the Codeless Connector Framework. _Im_Authentication_GoogleWorkspaceLogins true
Illumio SaaS Core Illumio SaaS Core events. _Im_Authentication_IllumioSaaSCore false
Linux Sshd Linux sshd activity reported using Syslog. _Im_Authentication_Sshd false
Linux Su Linux su activity reported using Syslog. _Im_Authentication_Su false
Linux Sudo Linux sudo activity reported using Syslog. _Im_Authentication_Sudo false
Microsoft Defender for IoT Microsoft Defender for IoT authentication events. _Im_Authentication_MD4IoT false
Microsoft Defender XDR Microsoft Defender XDR for Endpoint sign-ins for Windows and Linux. _Im_Authentication_M365Defender false
Microsoft Entra ID Microsoft Entra ID sign-ins, collected using the Microsoft Entra connector for regular sign-ins. _Im_Authentication_SigninLogs false
Microsoft Entra ID (Managed Identities) Microsoft Entra ID sign-ins, collected using the Microsoft Entra connector for Managed Identities sign-ins. _Im_Authentication_AADManagedIdentitySignInLogs false
Microsoft Entra ID (non-interactive) Microsoft Entra ID sign-ins, collected using the Microsoft Entra connector for non-interactive sign-ins. _Im_Authentication_AADNonInteractiveUserSignInLogs false
Microsoft Entra ID (Service Principal) Microsoft Entra ID sign-ins, collected using the Microsoft Entra connector for Service Principal sign-ins. _Im_Authentication_AADServicePrincipalSignInLogs false
Microsoft Windows Events Windows sign-ins (Events 4624, 4625, 4634, 4647) collected using Azure Monitor Agent or the Log Analytics Agent to the SecurityEvent or WindowsEvent tables. _Im_Authentication_MicrosoftWindowsEvent false
Okta (OktaSystemLogs) Okta authentication, collected using in the OktaSystemLogs table. _Im_Authentication_OktaSystemLogs false
Okta (V1) Okta authentication, collected using the Okta connector (V1 SSO). _Im_Authentication_OktaSSO false
Okta (V2) Okta authentication, collected using the Okta connector (V2). _Im_Authentication_OktaV2 Yes false
Oracle Cloud Infrastructure Oracle Cloud Infrastructure sign-in logs. _Im_Authentication_OracleOCI true
Palo Alto Cortex Data Lake Palo Alto Cortex Data Lake events. _Im_Authentication_PaloAltoCortexDataLake false
Palo Alto GlobalProtect Palo Alto PAN-OS GlobalProtect authentication events. _Im_Authentication_PaloAltoGlobalProtect true
Palo Alto PAN-OS Palo Alto PAN-OS authentication events. _Im_Authentication_PaloAltoPanOS true
Palo Alto Prisma Cloud Compute Palo Alto Prisma Cloud Compute authentication events. _Im_Authentication_PaloAltoPrismaCloud true
PostgreSQL PostgreSQL sign-in logs. _Im_Authentication_PostgreSQL false
Salesforce Login History Salesforce login history events. _Im_Authentication_SalesforceLoginHistory Yes (V2 table) true
Salesforce Real-Time Event Monitoring Salesforce Real-Time Event Monitoring authentication events. _Im_Authentication_SalesforceRealTimeEventMonitoring true
Salesforce Service Cloud Salesforce Service Cloud events. _Im_Authentication_SalesforceSC Yes true
SentinelOne SentinelOne events. _Im_Authentication_SentinelOne false
Vectra XDR Vectra XDR audit events. _Im_Authentication_VectraXDRAudit false
VMware Carbon Black Cloud VMware Carbon Black Cloud events. _Im_Authentication_VMwareCarbonBlackCloud false
VMware ESXi VMware ESXi authentication events. _Im_Authentication_VMwareESXi true
VMware vCenter VMware vCenter authentication events. _Im_Authentication_VMwareVCenter true
Wiz Cloud Wiz Cloud authentication events. _Im_Authentication_WizCloud true
Zscaler Private Access Zscaler Private Access authentication events. _Im_Authentication_ZscalerZPA true

DHCP Event parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized DHCP Event Logs Any event normalized at ingestion to the ASimDhcpEventLogs table. _Im_DhcpEvent_Native false
Infoblox BloxOne Infoblox BloxOne DHCP events. _Im_DhcpEvent_InfobloxBloxOne false

DNS parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized DNS Logs Any event normalized at ingestion to the ASimDnsActivityLogs table. The DNS connector for the Azure Monitor Agent uses the ASimDnsActivityLogs table. _Im_Dns_Native false
Azure Firewall Azure Firewall DNS logs. _Im_Dns_AzureFirewall false
Cisco Umbrella Cisco Umbrella DNS logs. _Im_Dns_CiscoUmbrella false
Corelight Zeek Corelight Zeek DNS logs. _Im_Dns_CorelightZeek false
CrowdStrike Falcon Data Replicator CrowdStrike Falcon Data Replicator DNS events. _Im_Dns_CrowdStrikeFalconDataReplicator Yes true
Fortinet FortiGate Fortinet FortiGate DNS logs. _Im_Dns_FortinetFortiGate Yes false
GCP DNS Google Cloud Platform DNS logs. _Im_Dns_Gcp false
Gigamon V-Series Gigamon V-Series Application Metadata Intelligence DNS events. _Im_Dns_GigamonVSeries true
Halcyon Halcyon DNS activity. _Im_Dns_Halcyon false
Infoblox BloxOne Infoblox BloxOne DNS events. _Im_Dns_InfobloxBloxOne false
Infoblox NIOS Infoblox NIOS, BIND, and BlueCat DNS servers. The same parser supports multiple sources. _Im_Dns_InfobloxNIOS false
Microsoft DNS Server Collected using the DNS connector for the Log Analytics Agent (legacy). _Im_Dns_MicrosoftOMS false
Microsoft DNS Server (NXlog) Microsoft DNS Server collected using NXlog. _Im_Dns_MicrosoftNXlog false
Microsoft Sysmon for Windows (Event) Sysmon DNS events (Event 22) collected using Azure Monitor Agent or the Log Analytics Agent (legacy) to the Event table. _Im_Dns_MicrosoftSysmon false
Microsoft Sysmon for Windows (WindowsEvent) Sysmon DNS events (Event 22) collected using Azure Monitor Agent or the Log Analytics Agent (legacy) to the WindowsEvent table. _Im_Dns_MicrosoftSysmonWindowsEvent false
SentinelOne SentinelOne DNS events. _Im_Dns_SentinelOne false
Vectra AI Vectra AI DNS events. _Im_Dns_VectraAI false
Zscaler ZIA Zscaler ZIA DNS logs. _Im_Dns_ZscalerZIA false

Email Event parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Email Event Logs Any event normalized at ingestion to the ASimEmailEventLogs table. _Im_EmailEvent_Native true
Microsoft Defender for Office 365 Email delivery records in the EmailEvents table. _Im_EmailEvent_MicrosoftDefenderOffice365 true
Proofpoint POD (MailLog) SMTP receipt and delivery records in the ProofpointPODMailLog_CL table. _Im_EmailEvent_ProofpointPODMailLog Yes true
Proofpoint POD (message) Message inspection records in the ProofpointPODMessage_CL table. _Im_EmailEvent_ProofpointPODMessage Yes true
Proofpoint TAP (blocked clicks) Blocked URL-click events in the ProofPointTAPClicksBlockedV2_CL table, normalized as EmailInteraction. _Im_EmailEvent_ProofpointTAPClicksBlocked Yes true
Proofpoint TAP (blocked messages) Blocked-message events in the ProofPointTAPMessagesBlockedV2_CL table. _Im_EmailEvent_ProofpointTAPBlocked Yes true
Proofpoint TAP (delivered messages) Delivered-message events in the ProofPointTAPMessagesDeliveredV2_CL table. _Im_EmailEvent_ProofpointTAPDelivered Yes true
Proofpoint TAP (permitted clicks) Permitted URL-click events in the ProofPointTAPClicksPermittedV2_CL table, normalized as EmailInteraction. _Im_EmailEvent_ProofpointTAPClicksPermitted Yes true

File Activity parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized File Event Logs Any event normalized at ingestion to the ASimFileEventLogs table. _Im_FileEvent_Native false
AWS CloudTrail AWS CloudTrail file events. _vim_FileEvent_AWSCloudTrail Yes true
Azure Blob Storage Azure Blob Storage file events. _Im_FileEvent_AzureBlobStorage false
Azure File Storage Azure File Storage events. _Im_FileEvent_AzureFileStorage false
Azure Queue Storage Azure Queue Storage events. _Im_FileEvent_AzureQueueStorage false
Azure Table Storage Azure Table Storage events. _Im_FileEvent_AzureTableStorage false
CrowdStrike Falcon Data Replicator CrowdStrike Falcon Data Replicator file events. _Im_FileEvent_CrowdStrikeFalconDataReplicator Yes true
Google Workspace Google Workspace file events. _Im_FileEvent_GoogleWorkspace false
Linux Sysmon (Created Events) Sysmon for Linux file created events (Events 11). _Im_FileEvent_LinuxSysmonFileCreated false
Linux Sysmon (Deleted Events) Sysmon for Linux file deleted events (Events 23, 26). _Im_FileEvent_LinuxSysmonFileDeleted false
Microsoft Defender XDR Microsoft Defender XDR for Endpoint file events. _Im_FileEvent_Microsoft365D false
Microsoft Security Events Windows file events (Event 4663) collected using the Security Events connector. _Im_FileEvent_MicrosoftSecurityEvents false
Microsoft SharePoint Microsoft Office 365 SharePoint and OneDrive events, collected using the Office Activity connector. _Im_FileEvent_MicrosoftSharePoint false
Microsoft Sysmon for Windows (Event) Sysmon for Windows file events (Events 11, 23, 26) collected to the Event table. _Im_FileEvent_MicrosoftSysmon false
Microsoft Sysmon for Windows (WindowsEvent) Sysmon for Windows file events (Events 11, 23, 26) collected to the WindowsEvent table. _Im_FileEvent_MicrosoftSysmonWindowsEvent false
Microsoft Windows Events Windows file events (Event 4663) collected to the WindowsEvent table. _Im_FileEvent_MicrosoftWindowsEvents false
Salesforce Real-Time Event Monitoring Salesforce Real-Time Event Monitoring file events. _Im_FileEvent_SalesforceRealTimeEventMonitoring true
SentinelOne SentinelOne file events. _Im_FileEvent_SentinelOne false
VMware Carbon Black Cloud VMware Carbon Black Cloud file events. _Im_FileEvent_VMwareCarbonBlackCloud false

Network Session parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Network Session Logs Any event normalized at ingestion to the ASimNetworkSessionLogs table. The Firewall connector for the Azure Monitor Agent uses this table. _Im_NetworkSession_Native false
AppGate SDP IP connection logs collected using Syslog. _Im_NetworkSession_AppGateSDP false
AWS GuardDuty AWS GuardDuty network findings. _Im_NetworkSession_AWSGuardDuty true
AWS VPC logs Collected using the AWS S3 connector. _Im_NetworkSession_AWSVPC Yes false
Azure Firewall Azure Firewall network logs. _Im_NetworkSession_AzureFirewall false
Azure Monitor VMConnection Collected as part of the Azure Monitor VM Insights solution. _Im_NetworkSession_VMConnection false
Azure NSG Azure Network Security Groups flow logs. _Im_NetworkSession_AzureNSG false
Barracuda CEF Barracuda events collected using CEF. _Im_NetworkSession_BarracudaCEF false
Barracuda WAF Barracuda WAF events. _Im_NetworkSession_BarracudaWAF false
Check Point SmartDefense Check Point SmartDefense network events. _Im_NetworkSession_CheckPointSmartDefense true
Checkpoint Firewall Checkpoint Firewall events collected using CEF. _Im_NetworkSession_CheckPointFirewall false
Cisco ASA Cisco ASA events collected using CEF. _Im_NetworkSession_CiscoASA false
Cisco Firepower Cisco Firepower events. _Im_NetworkSession_CiscoFirepower false
Cisco FTD Cisco Firepower Threat Defense network events. _Im_NetworkSession_CiscoFTD true
Cisco ISE Cisco ISE events. _Im_NetworkSession_CiscoISE false
Cisco Meraki Cisco Meraki events collected using the API connector or Syslog. _Im_NetworkSession_CiscoMeraki false
Cisco Meraki (Syslog) Cisco Meraki events collected to the table Syslog. _Im_NetworkSession_CiscoMerakiSyslog false
Corelight Zeek Corelight Zeek network events. _Im_NetworkSession_CorelightZeek false
CrowdStrike Falcon CrowdStrike Falcon Host events. _Im_NetworkSession_CrowdStrikeFalconHost false
CrowdStrike Falcon Data Replicator CrowdStrike Falcon Data Replicator network events. _Im_NetworkSession_CrowdStrikeFalconDataReplicator Yes true
ForcePoint Firewall ForcePoint Firewall events. _Im_NetworkSession_ForcePointFirewall false
Fortinet FortiGate Fortinet FortiGate firewall events collected using Syslog. _Im_NetworkSession_FortinetFortiGate Yes false
Gigamon V-Series Gigamon V-Series Application Metadata Intelligence network events. _Im_NetworkSession_GigamonVSeries true
Illumio SaaS Core Illumio SaaS Core events. _Im_NetworkSession_IllumioSaaSCore false
Microsoft Defender for IoT (Agent) Microsoft Defender for IoT micro agent events. _Im_NetworkSession_MD4IoTAgent false
Microsoft Defender for IoT (Sensor) Microsoft Defender for IoT micro sensor events. _Im_NetworkSession_MD4IoTSensor false
Microsoft Defender XDR Microsoft Defender XDR for Endpoint network events. _Im_NetworkSession_Microsoft365Defender false
Microsoft Sysmon for Linux Sysmon for Linux network events (Event 3). _Im_NetworkSession_LinuxSysmon false
Microsoft Sysmon for Windows (Event) Sysmon for Windows network events (Event 3) collected to the Event table. _Im_NetworkSession_MicrosoftSysmon false
Microsoft Sysmon for Windows (WindowsEvent) Sysmon for Windows network events (Event 3) collected to the WindowsEvent table. _Im_NetworkSession_MicrosoftSysmonWindowsEvent false
Microsoft Windows Firewall Windows Firewall events (Events 5150-5159) collected using Azure Monitor Agent or the Log Analytics Agent. _Im_NetworkSession_MicrosoftWindowsEventFirewall false
Microsoft Windows Security Events Firewall Windows Firewall events collected via Security Events connector. _Im_NetworkSession_MicrosoftSecurityEventFirewall false
NTA NetAnalytics Network Traffic Analytics events. _Im_NetworkSession_NTANetAnalytics false
Palo Alto Cortex Data Lake Palo Alto Cortex Data Lake events. _Im_NetworkSession_PaloAltoCortexDataLake false
Palo Alto PanOS Palo Alto PanOS traffic logs collected using CEF. _Im_NetworkSession_PaloAltoCEF false
SentinelOne SentinelOne network events. _Im_NetworkSession_SentinelOne false
SonicWall Firewall SonicWall Firewall events. _Im_NetworkSession_SonicWallFirewall false
Vectra AI Vectra AI network events. Supports the pack parameter. _Im_NetworkSession_VectraAI true
VMware Carbon Black Cloud VMware Carbon Black Cloud network events. _Im_NetworkSession_VMwareCarbonBlackCloud false
WatchGuard Fireware OS WatchGuard Fireware OS events collected using Syslog. _Im_NetworkSession_WatchGuardFirewareOS false
Zscaler Private Access Zscaler Private Access network events in the ZPA_CL table. _Im_NetworkSession_ZscalerZPA true
Zscaler ZIA Zscaler ZIA firewall logs collected using CEF. _Im_NetworkSession_ZscalerZIA false

Process Event parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Process Event Logs Any event normalized at ingestion to the ASimProcessEventLogs table. _Im_ProcessEvent_Native false
CrowdStrike Falcon Endpoint Protection Process creation, observation, termination, and termination request events in the CrowdStrike_Process_Events_CL table. _Im_ProcessEvent_CrowdStrikeFalconEndpointProtection Yes false
Linux Sysmon (Create) Sysmon for Linux process creation events (Events 1). _Im_ProcessCreate_LinuxSysmon false
Linux Sysmon (Terminate) Sysmon for Linux process termination events (Events 5). _Im_ProcessTerminate_LinuxSysmon false
Microsoft Defender for IoT (Create) Microsoft Defender for IoT process creation events. _Im_ProcessCreate_MD4IoT false
Microsoft Defender for IoT (Terminate) Microsoft Defender for IoT process termination events. _Im_ProcessTerminate_MD4IoT false
Microsoft Defender XDR Microsoft Defender XDR for Endpoint process events. _Im_ProcessEvent_Microsoft365D false
Microsoft Security Events (Create) Windows Security Events process creation events (Events 4688). _Im_ProcessCreate_MicrosoftSecurityEvents false
Microsoft Security Events (Terminate) Windows Security Events process termination events (Events 4689). _Im_ProcessTerminate_MicrosoftSecurityEvents false
Microsoft Sysmon for Windows (Create, WindowsEvent) Sysmon process creation events (Event 1) collected to the WindowsEvent table. _Im_ProcessEvent_CreateMicrosoftSysmonWindowsEvent false
Microsoft Sysmon for Windows (Create) Sysmon for Windows process events (Event 1) collected to the Event tables. _Im_ProcessEvent_CreateMicrosoftSysmon false
Microsoft Sysmon for Windows (Terminate, WindowsEvent) Sysmon process termination events (Event 5) collected to the WindowsEvent table. _Im_ProcessTerminate_MicrosoftSysmonWindowsEvent false
Microsoft Sysmon for Windows (Terminate) Sysmon for Windows process events (Event 5) collected to the Event tables. _Im_ProcessTerminate_MicrosoftSysmon false
Microsoft Windows Events (Create) Windows process events (Event 4688) collected to the WindowsEvent table. _Im_ProcessCreate_MicrosoftWindowsEvents false
Microsoft Windows Events (Terminate) Windows process events (Event 4689) collected to the WindowsEvent table. _Im_ProcessTerminate_MicrosoftWindowsEvents false
SentinelOne SentinelOne process events. _Im_ProcessCreate_SentinelOne false
Trend Micro Vision One Trend Micro Vision One process events. _Im_ProcessCreate_TrendMicroVisionOne false
VMware Carbon Black Cloud (Create) VMware Carbon Black Cloud process creation events. _Im_ProcessCreate_VMwareCarbonBlackCloud false
VMware Carbon Black Cloud (Terminate) VMware Carbon Black Cloud process termination events. _Im_ProcessTerminate_VMwareCarbonBlackCloud false

Registry Event parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Registry Event Logs Any event normalized at ingestion to the ASimRegistryEventLogs table. _Im_RegistryEvent_Native false
CrowdStrike Falcon Data Replicator CrowdStrike Falcon Data Replicator registry events. _Im_RegistryEvent_CrowdStrikeFalconDataReplicator Yes true
Microsoft Defender XDR Microsoft Defender XDR for Endpoint registry events. _Im_RegistryEvent_Microsoft365D false
Microsoft Security Events Windows Security Events registry events (Events 4657, 4663). _Im_RegistryEvent_MicrosoftSecurityEvent false
Microsoft Sysmon for Windows (Event) Sysmon for Windows registry events (Events 12, 13, 14) collected to the Event table. _Im_RegistryEvent_MicrosoftSysmon false
Microsoft Sysmon for Windows (WindowsEvent) Sysmon registry events collected to the WindowsEvent table. _Im_RegistryEvent_MicrosoftSysmonWindowsEvent false
Microsoft Windows Events Windows registry events collected to the WindowsEvent table. _Im_RegistryEvent_MicrosoftWindowsEvent false
SentinelOne SentinelOne registry events. _Im_RegistryEvent_SentinelOne false
Trend Micro Vision One Trend Micro Vision One registry events. _Im_RegistryEvent_TrendMicroVisionOne false
VMware Carbon Black Cloud VMware Carbon Black Cloud registry events. _Im_RegistryEvent_VMwareCarbonBlackCloud false

User Management parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized User Management Logs Any event normalized at ingestion to the ASimUserManagementLogs table. _Im_UserManagement_Native false
Alibaba Cloud ActionTrail Alibaba Cloud ActionTrail user management events. _Im_UserManagement_AlibabaCloudActionTrail true
AWS CloudTrail AWS CloudTrail user management events. _Im_UserManagement_AWSCloudTrail Yes true
Cisco ISE Cisco ISE user management events. _Im_UserManagement_CiscoISE false
CrowdStrike Falcon Data Replicator CrowdStrike Falcon Data Replicator user management events. _Im_UserManagement_CrowdStrikeFalconDataReplicator Yes true
Linux Authpriv Linux authpriv user management events. _Im_UserManagement_LinuxAuthpriv false
Microsoft Security Events Windows Security Events user management events. _Im_UserManagement_MicrosoftSecurityEvent false
Microsoft Windows Events Windows user management events collected to the WindowsEvent table. _Im_UserManagement_MicrosoftWindowsEvent false
Salesforce Real-Time Event Monitoring Salesforce Real-Time Event Monitoring user management events. _Im_UserManagement_SalesforceRealTimeEventMonitoring true
SentinelOne SentinelOne user management events. _Im_UserManagement_SentinelOne false

Web Session parsers

Source Notes Query Time Parser Ingest Time Parser Uses pack parameter
Normalized Web Session Logs Any event normalized at ingestion to the ASimWebSessionLogs table. _Im_WebSession_Native false
Apache HTTP Server Apache HTTP Server logs. _Im_WebSession_ApacheHTTPServer false
AWS WAF AWS Web Application Firewall events. _Im_WebSession_AWSWAF true
Azure Firewall Azure Firewall web session logs. _Im_WebSession_AzureFirewall false
Barracuda CEF Barracuda events collected using CEF. _Im_WebSession_BarracudaCEF false
Barracuda WAF Barracuda WAF events. _Im_WebSession_BarracudaWAF false
Cisco Firepower Cisco Firepower web events. _Im_WebSession_CiscoFirepower false
Cisco Meraki Cisco Meraki web events. _Im_WebSession_CiscoMeraki false
Cisco Umbrella Cisco Umbrella proxy logs. _Im_WebSession_CiscoUmbrella true
Citrix NetScaler Citrix NetScaler web events. _Im_WebSession_CitrixNetScaler false
Cloudflare One Cloudflare One web session events. _Im_WebSession_CloudflareOne true
F5 ASM F5 ASM web events. _Im_WebSession_F5ASM false
Fortinet FortiGate Fortinet FortiGate web session logs. _Im_WebSession_FortinetFortiGate Yes false
Internet Information Services (IIS) IIS logs collected using Azure Monitor Agent or Log Analytics Agent. _Im_WebSession_IIS false
Palo Alto Cortex Data Lake Palo Alto Cortex Data Lake events. _Im_WebSession_PaloAltoCortexDataLake false
Palo Alto PanOS Palo Alto PanOS threat logs collected using CEF. _Im_WebSession_PaloAltoCEF false
Salesforce Real-Time Event Monitoring Salesforce Real-Time Event Monitoring web session events. _Im_WebSession_SalesforceRealTimeEventMonitoring true
Salesforce Service Cloud Salesforce Service Cloud web session events. _Im_WebSession_SalesforceServiceCloud Yes true
SonicWall Firewall SonicWall Firewall web events. _Im_WebSession_SonicWallFirewall false
Squid Proxy Squid Proxy web logs. _Im_WebSession_SquidProxy false
Vectra AI Vectra AI web events. Supports the pack parameter. _Im_WebSession_VectraAI true
Zscaler ZIA Zscaler ZIA web logs collected using CEF. _Im_WebSession_ZscalerZIA false

Next steps

Related content

Learn more about ASIM parsers:

Learn more about ASIM:

  • อัปเดตล่าสุดเมื่อ