What Changed

Both the unified (ASimAlertEventCiscoSecureEndpoint) and filtering (vimAlertEventCiscoSecureEndpoint) parsers have been updated (v0.1.0 -> v0.1.1) to add TimeGenerated and Type to the explicit project statement at the end of the parser query.

The CI custom-table schema for CiscoSecureEndpointEventsV2_CL has also been updated to declare the Type column.

Parser Impact

  • Schema: AlertEvent, normalising from CiscoSecureEndpointEventsV2_CL
  • Fields added to output projection: TimeGenerated, Type
  • These fields are now mandatory in the ASIM AlertEvent schema. Prior to this fix, any query or Analytic Rule using ASimAlertEventCiscoSecureEndpoint and referencing TimeGenerated or Type would receive null for all rows from this parser – a silent data fidelity gap, not a cosmetic issue.
  • No changes to detection logic, field mappings, thresholds, or filter parameters.
  • Safe for existing detections: the change is additive to the output projection only. No previously-returned field was renamed or removed.

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/CiscoSecureEndpointEventsV2_CL.json
Parsers/ASimAlertEvent/ARM/ASimAlertEventCiscoSecureEndpoint/ASimAlertEventCiscoSecureEndpoint.json
Parsers/ASimAlertEvent/ARM/vimAlertEventCiscoSecureEndpoint/vimAlertEventCiscoSecureEndpoint.json
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventCiscoSecureEndpoint.md
Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventCiscoSecureEndpoint.md
Parsers/ASimAlertEvent/Parsers/ASimAlertEventCiscoSecureEndpoint.yaml
Parsers/ASimAlertEvent/Parsers/vimAlertEventCiscoSecureEndpoint.yaml