What Changed
Both ASimDnsAzureFirewall (v0.4.0 to v0.4.1) and vimDnsAzureFirewall (v0.4.0 to v0.4.1) parsers received a defensive fix in their AzureDiagnostics branches.
A column_ifexists guard was added before any reference to msg_s in all four affected parser branches (two per file: the DNS Request branch and the Error branch).
Parser Impact
Schema: ASIM imDns / vimDns normalising Azure Firewall DNS proxy logs.
What was broken: In resource-specific diagnostic log mode, Azure Firewall routes AzureFirewallDnsProxy category logs exclusively to the AZFWDnsQuery table. In this configuration, msg_s is absent from AzureDiagnostics. Any KQL union that includes the AzureDiagnostics branch would fail with Failed to resolve scalar expression named msg_s, aborting the entire union.
Data fidelity impact: Deployments running Azure Firewall in resource-specific logging mode had the AzureDiagnostics branch of these parsers silently abort. This results in partial or complete loss of DNS query data from that source branch. Any detections or hunting queries using imDns or vimDns against those environments were operating with incomplete data, creating a blind spot for DNS-based threat detection (C2 beaconing, DNS tunneling, domain generation algorithm activity).
After the fix: column_ifexists makes the reference safe. The branch continues, the filter on msg_s startswith DNS Request simply matches nothing for AzureDiagnostics rows where msg_s is empty, and the AZFWDnsQuery branch provides the actual data. No change to normalised field names or ASIM schema mapping, safe for existing detections.
Affected Files
Parsers/ASimDns/CHANGELOG/ASimDnsAzureFirewall.md
Parsers/ASimDns/CHANGELOG/vimDnsAzureFirewall.md
Parsers/ASimDns/Parsers/ASimDnsAzureFirewall.yaml
Parsers/ASimDns/Parsers/vimDnsAzureFirewall.yaml