What Changed

Two new ASIM AgentEvent parsers have been added to normalize Anthropic Claude Compliance logs ingested via the BlueVoyant CCF connector into the ASIM AgentEvent schema:

  • ASimAgentEventAnthropicClaudeCompliance - the unified (non-filtering) parser
  • vimAgentEventAnthropicClaudeCompliance - the filtering variant with full parameter support (starttime, endtime, agentid_has_any, agentname_has_any, username_has_any)

Both parsers have been registered into the umbrella ASimAgentEvent / imAgentEvent parsers (version bumped to 0.1.1), making them available to any query or detection that calls the normalised imAgentEvent() function.

A CI custom-table definition for BV_ClaudeCompliance_ComplianceActivities_CL and sample ingested log data were also added.

Additionally, the ASimAgentEvent README previously linked to a broken ASimAgentEntity changelog path - this has been corrected to ASimAgentEvent.

Parser Impact

  • Schema: AgentEvent (v0.1.0), normalising from BV_ClaudeCompliance_ComplianceActivities_CL
  • Source filter: type_CF != compliance_api_accessed - API polling requests for logs are excluded; only substantive compliance activity events are normalised
  • Key field mappings:
    • TargetAgentId resolved via coalesce(claude_project_id, claude_chat_id, claude_file_id, claude_artifact_id) - priority-ordered agent context
    • TargetAgentName resolved from mcp_server_name, plugin_name, skill_name, group_name, service_name, or URL path extraction
    • ActorUserId / ActorUsername resolved from nested actor.user_id, actor.email_address, actor.unauthenticated_email_address
    • ActorScopeId coalesces actor.api_key_id and actor.service_account_id for API-key vs service-account attribution
    • EventResult derived from HTTP status_code: 2xx -> Success, 4xx+ -> Failure
  • Entity fields surfaced: SrcIpAddr, HttpUserAgent, ActorUsername, ActorUserId
  • pack mode: AdditionalFields bag includes request_id, url, chat/project/file/artifact IDs, organization_id, workspace_id, decision, reason, session_id

Prior to this PR, imAgentEvent() returned no rows for Anthropic Claude Compliance data - the source table was entirely outside ASIM normalisation coverage.

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/BV_ClaudeCompliance_ComplianceActivities_CL.json
Parsers/ASimAgentEvent/ARM/ASimAgentEvent/ASimAgentEvent.json
Parsers/ASimAgentEvent/ARM/ASimAgentEvent/README.md
Parsers/ASimAgentEvent/ARM/ASimAgentEventAnthropicClaudeCompliance/ASimAgentEventAnthropicClaudeCompliance.json
Parsers/ASimAgentEvent/ARM/ASimAgentEventAnthropicClaudeCompliance/README.md
Parsers/ASimAgentEvent/ARM/FullDeploymentAgentEvent.json
Parsers/ASimAgentEvent/ARM/imAgentEvent/imAgentEvent.json
Parsers/ASimAgentEvent/ARM/vimAgentEventAnthropicClaudeCompliance/README.md
Parsers/ASimAgentEvent/ARM/vimAgentEventAnthropicClaudeCompliance/vimAgentEventAnthropicClaudeCompliance.json
Parsers/ASimAgentEvent/CHANGELOG/ASimAgentEvent.md
Parsers/ASimAgentEvent/CHANGELOG/ASimAgentEventAnthropicClaudeCompliance.md
Parsers/ASimAgentEvent/CHANGELOG/imAgentEvent.md
Parsers/ASimAgentEvent/CHANGELOG/vimAgentEventAnthropicClaudeCompliance.md
Parsers/ASimAgentEvent/Parsers/ASimAgentEvent.yaml
Parsers/ASimAgentEvent/Parsers/ASimAgentEventAnthropicClaudeCompliance.yaml
Parsers/ASimAgentEvent/Parsers/imAgentEvent.yaml
Parsers/ASimAgentEvent/Parsers/vimAgentEventAnthropicClaudeCompliance.yaml
Sample Data/ASIM/Anthropic_Claude Compliance_AgentEvent_IngestedLogs.csv