What Changed

The OpenAI data connector has been updated to normalize chat completions data into the ASIM (Advanced Security Information Model) standard table ASimAgentEventLogs rather than the custom OpenAIChatCompletions_CL table.

Security Impact (Visibility & Fidelity)

  • Data Standardization: Chat completions now follow the ASIM AgentEvent schema, enabling standardized AI usage monitoring across multiple AI platforms within Microsoft Sentinel
  • Cross-Product Correlation: Normalizing to ASimAgentEventLogs allows for unified queries across different AI/LLM platforms that implement ASIM standards
  • Field Mapping Enhancement: The DCR transform now maps OpenAI response fields to standard ASIM fields (EventUid, EventRequestId, ModelName, InputTokensUsed, OutputTokensUsed, EventVendor, EventProduct)
  • Parser Updates: The OpenAIChatCompletions alias function now filters ASimAgentEventLogs by OpenAI-specific fields rather than querying a custom table

Technical Changes

  • Removed custom table definition OpenAIChatCompletions_Table.json
  • Updated DCR output stream from Custom-OpenAIChatCompletions_CL to Microsoft-ASimAgentEventLogs
  • Rewrote transform KQL to map to ASIM schema with standard fields like EventVendor: OpenAI, EventProduct: OpenAI API Platform, and EventType: ChatCompletion
  • Updated connector definition, polling config, and UI documentation to reference the new table structure
  • Solution version bumped from 3.0.0 to 3.1.0

Existing deployments using the OpenAI connector should update to benefit from standardized AI monitoring capabilities and improved query correlation across AI platforms.

Affected Files

Solutions/OpenAI/Data Connectors/OpenAI_CCP/OpenAIAuditLogs_Table.json
Solutions/OpenAI/Data Connectors/OpenAI_CCP/OpenAIChatCompletions_Table.json
Solutions/OpenAI/Data Connectors/OpenAI_CCP/OpenAI_ConnectorDefinition.json
Solutions/OpenAI/Data Connectors/OpenAI_CCP/OpenAI_DCR.json
Solutions/OpenAI/Data Connectors/OpenAI_CCP/OpenAI_PollingConfig.json
Solutions/OpenAI/Parsers/parser_OpenAIChatCompletionsAliasFunction.json
Tools/Create-Azure-Sentinel-Solution/common/standardLogStreams.ps1
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, Solution_OpenAI.json, mainTemplate.json)