What Changed

The ASIM AssetEntity schema definition in the ASimTester validation framework has been updated to:

  1. Make EntitySource enumerated: Previously a free-form string field, EntitySource now enforces specific values: Azure, Microsoft365, GCP, AWS, Other
  2. Add EntityOriginalSource field: New optional string field for tracking the original data source identifier

Schema Impact

These changes affect how asset entities are normalized in ASIM-compliant parsers and how validation testing occurs:

  • EntitySource enumeration: Parsers must now map asset sources to the predefined cloud platform values (Azure|Microsoft365|GCP|AWS|Other). This standardizes asset origin classification across different data sources.
  • EntityOriginalSource: Provides a new field to preserve the original source system identifier when EntitySource is normalized to a standard value.

No change to existing normalized field names — safe for current detections using ASIM asset parsers. However, parsers populating EntitySource with custom values will need updates to comply with the enumeration.

Affected Files

ASIM/dev/ASimTester/ASimTester.csv