Short for Advanced Security Information Model parsers: KQL functions that map Microsoft Sentinel data onto shared schemas when queried. That happens after ingestion has been charged, so ingestion costs are unaffected.
Also called Advanced Security Information Model parsers.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains ASIM parsers in context, with comparison tables and the common traps.
Terms in this definition
- KQL
Kusto Query Language, used read-only to query Azure Data Explorer, Log Analytics and Microsoft Sentinel; log alert rules are written in it too.
- Microsoft Sentinel
Microsoft's cloud-native SIEM, with SOAR capabilities, which stores and queries its data in a Log Analytics workspace.