ASIM on sentinelchangelog.nethttp://sentinelchangelog.net/tags/asim/Recent content in ASIM on sentinelchangelog.netHugo -- 0.157.0enFri, 10 Jul 2026 16:24:56 +0000Cisco Secure Endpoint ASIM AlertEvent Parser: Missing Mandatory Fields Causing Data Fidelity Gaphttp://sentinelchangelog.net/posts/2026-07-10-pr-14631/Fri, 10 Jul 2026 16:24:56 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14631/TimeGenerated and Type fields were absent from the Cisco Secure Endpoint ASIM AlertEvent parser output, causing null returns for all rows referencing these now-mandatory schema fields in downstream queries.New ASIM AgentEvent Parser Unlocks Anthropic Claude Compliance Log Normalizationhttp://sentinelchangelog.net/posts/2026-07-10-pr-14578/Fri, 10 Jul 2026 16:24:01 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14578/Two new ASIM AgentEvent parsers normalize Anthropic Claude Compliance API logs (via BlueVoyant CCF connector) into the ASIM AgentEvent schema, enabling unified hunting across AI agent activity events.Azure Firewall ASIM DNS Parsers: Silent Union Failure Fixed for Resource-Specific Log Modehttp://sentinelchangelog.net/posts/2026-07-09-pr-14609/Thu, 09 Jul 2026 22:21:33 +0000http://sentinelchangelog.net/posts/2026-07-09-pr-14609/When Azure Firewall is configured to send logs only to the resource-specific AZFWDnsQuery table, the AzureDiagnostics branch of both ASimDnsAzureFirewall and vimDnsAzureFirewall parsers was aborting with a scalar resolution error, dropping all DNS query data from those branches entirely.Cisco Meraki CCF Connector Expands to Cover Rogue AP Detection and Network Inventoryhttp://sentinelchangelog.net/posts/2026-07-08-pr-14629/Wed, 08 Jul 2026 21:22:13 +0000http://sentinelchangelog.net/posts/2026-07-08-pr-14629/The Cisco Meraki CCF connector (v3.1.0) adds four new ingestion streams - Organizations, Organization Networks, Network Clients, and Wireless Air Marshal Events - extending coverage beyond the original ASIM event types to include wireless threat detection and full network inventory visibility.New ASIM NetworkSession Parser for Cisco FTD Extends Network Visibility via AMA Connectorhttp://sentinelchangelog.net/posts/2026-06-30-pr-14569/Tue, 30 Jun 2026 22:04:57 +0000http://sentinelchangelog.net/posts/2026-06-30-pr-14569/Cisco Firepower Threat Defense (FTD) logs ingested via the Cisco ASA/FTD AMA connector can now be normalised into the ASIM NetworkSession schema, enabling source-agnostic detections and hunting queries to run against FTD firewall and IDS events.New ASIM Authentication Parser for Cisco Firepower Threat Defense Closes Syslog Auth Visibility Gaphttp://sentinelchangelog.net/posts/2026-06-30-pr-14581/Tue, 30 Jun 2026 16:24:52 +0000http://sentinelchangelog.net/posts/2026-06-30-pr-14581/A new ASIM Authentication parser for Cisco FTD normalises SSH login success and failure events from Syslog into the imAuthentication/ASimAuthentication schema, enabling source-agnostic detection coverage for Cisco firewall authentication activity.ASIM Schema Docs Pruned -- Canonical Definitions Moved to Microsoft Learnhttp://sentinelchangelog.net/posts/2026-06-30-pr-14586/Tue, 30 Jun 2026 16:15:57 +0000http://sentinelchangelog.net/posts/2026-06-30-pr-14586/Nine ASIM schema YAML files and a parsers list have been removed from the repo as the canonical schema definitions are now hosted on Microsoft Learn, with two new schemas (Agent Event and Asset Entity) documented in the README.New Solution: Hybrid Attack Chain Hunting Across On-Premises, Cloud, and Kuberneteshttp://sentinelchangelog.net/posts/2026-06-29-pr-14427/Mon, 29 Jun 2026 04:21:48 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14427/A new Microsoft Sentinel Solution ships 55+ multi-stage hunting queries designed to detect attacker pivots across on-premises identity, Azure control plane, Kubernetes, and Microsoft Entra ID – covering full kill chains that individual, single-source detections routinely miss.Salesforce Service Cloud ASIM Authentication Parser: Extended to Cover CCF V2/V3 Connector Tableshttp://sentinelchangelog.net/posts/2026-06-26-pr-14215/Fri, 26 Jun 2026 17:34:38 +0000http://sentinelchangelog.net/posts/2026-06-26-pr-14215/The ASIM Authentication parser for Salesforce Service Cloud now normalises logs from the V2 and V3 CCF connector tables – environments using the updated codeless connectors were previously producing zero normalised authentication events.Cisco ISE ASIM Auth Parser: Regex Fix Restores EventOriginalType Extraction Across Log Format Variantshttp://sentinelchangelog.net/posts/2026-06-25-pr-14554/Thu, 25 Jun 2026 18:49:15 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14554/A broken regex in both the ASimAuthenticationCiscoISE and vimAuthenticationCiscoISE parsers caused EventOriginalType to return null for Cisco ISE syslog messages that include extended timestamp/sequence prefixes, silently dropping event classification for those log variants.Fortinet FortiGate ASIM Auth Parser: Failed and System-Success Login Events Were Silently Droppedhttp://sentinelchangelog.net/posts/2026-06-24-pr-14548/Wed, 24 Jun 2026 16:48:14 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-14548/The FortiGate ASIM Authentication parser was silently discarding event:system failed and event:system success log types, creating a blind spot for credential-based attacks and successful system authentications on FortiGate devices.New ASIM AlertEvent Parser for Google SecOps Extends Normalised Detection Coveragehttp://sentinelchangelog.net/posts/2026-06-23-pr-14221/Tue, 23 Jun 2026 21:29:46 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14221/A new ASIM AlertEvent parser pair normalises Google SecOps Detection Alerts from the DetectionAlerts_CL custom table into the ASIM AlertEvent schema, enabling source-agnostic alert hunting and cross-platform detection rules against Google SecOps data.Threat Intelligence (NEW): Broken Connector Mappings and Case-Sensitive Rule Names Fixed Across 36 Analytic Ruleshttp://sentinelchangelog.net/posts/2026-06-23-pr-14300/Tue, 23 Jun 2026 12:08:41 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14300/Two customer-reported issues are resolved: EmailEvents and EmailUrlInfo rules were mapped to the wrong connectors (Office365 instead of MicrosoftThreatProtection), and inconsistent capitalisation in rule names was silently breaking customer Playbook automations.New ASIM WebSession Parser Brings AWS WAF Traffic into Normalized Detection Coveragehttp://sentinelchangelog.net/posts/2026-06-22-pr-14496/Mon, 22 Jun 2026 21:57:23 +0000http://sentinelchangelog.net/posts/2026-06-22-pr-14496/AWS WAF web session logs can now be ingested and normalized via the ASIM WebSession schema, enabling source-agnostic detections against WAF allow/block/challenge/captcha decisions from the AWSWAF table.CrowdStrike Falcon AlertEvent ASIM Parser: Falcon Detections Now Normalised into Unified Alert Schemahttp://sentinelchangelog.net/posts/2026-06-19-pr-14488/Fri, 19 Jun 2026 23:45:23 +0000http://sentinelchangelog.net/posts/2026-06-19-pr-14488/A new ASIM AlertEvent parser for CrowdStrike Falcon ingested via CCF normalises detection data from the CrowdStrikeDetections table into the ASIM AlertEvent schema, enabling source-agnostic detection and hunting queries across EDR alert data.Netskope Security Cloud Joins ASIM AlertEvent Schema — Threats Now Normalised from NetskopeAlerts_CLhttp://sentinelchangelog.net/posts/2026-06-17-pr-14493/Wed, 17 Jun 2026 18:29:45 +0000http://sentinelchangelog.net/posts/2026-06-17-pr-14493/A new ASIM AlertEvent parser for Netskope Security Cloud normalises DLP, malware, C2, IPS, compromised credential, UBA, and policy alerts from the NetskopeAlerts_CL table into the standard AlertEvent schema, enabling source-agnostic detections and hunting across Netskope data.ASIM Parser CI Workflows Fixed: File-Not-Found Errors Were Silently Skipping All Parser Testshttp://sentinelchangelog.net/posts/2026-06-16-pr-14499/Tue, 16 Jun 2026 22:44:02 +0000http://sentinelchangelog.net/posts/2026-06-16-pr-14499/The ASIM parser schema and data ingestion test workflows were failing to read parser YAML and sample data files at runtime due to broken URL-based file access; this fix switches to local filesystem reads, restoring test coverage for all modified ASIM parsers.Palo Alto XDR ASIM Parser: Normalizing Cortex XDR Alert Data for Cross-Platform Detectionhttp://sentinelchangelog.net/posts/2026-06-12-pr-14401/Fri, 12 Jun 2026 21:43:09 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14401/New ASIM AlertEvent parser brings Palo Alto Cortex XDR alert normalization to Microsoft Sentinel via CCF connector.ASIM Template Validation: Reliability Fix for Flaky Test Results and Performance Optimizationhttp://sentinelchangelog.net/posts/2026-06-12-pr-14469/Fri, 12 Jun 2026 20:19:55 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14469/ASIM parser validation workflow updated to use local repository files instead of raw GitHub URLs, fixing malformed URL issues causing test failures.ASIM Validator Infrastructure: Schema Testing Migrated to Remote Download Patternhttp://sentinelchangelog.net/posts/2026-06-12-pr-14473/Fri, 12 Jun 2026 19:59:54 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14473/ASIM parser validation tooling updated to download ASimSchemaTester from GitHub instead of using hardcoded inline function.ASIM Schema Tester: Fixing Critical Validation Gap for Common Fieldshttp://sentinelchangelog.net/posts/2026-06-12-pr-14468/Fri, 12 Jun 2026 01:12:32 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14468/Critical fix restores validation of Common schema fields alongside schema-specific fields in ASIM parser testing.StealthTalk: New Enterprise Authentication Monitoring Solution with MITRE-Mapped Detection Portfoliohttp://sentinelchangelog.net/posts/2026-06-10-pr-14259/Wed, 10 Jun 2026 10:24:48 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14259/Complete StealthTalk Enterprise solution delivers four analytic rules targeting credential attacks (T1078, T1110, T1098) plus ASIM Authentication parsers and Teams integration.Bitdefender GravityZone Parser: Critical Fix for Network Sandboxing Event Parsing Failurehttp://sentinelchangelog.net/posts/2026-06-10-pr-14412/Wed, 10 Jun 2026 06:42:06 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14412/ASIM parser for Bitdefender GravityZone was failing due to missing type cast, preventing ingestion of network sandboxing alerts.Salesforce Service Cloud: New ASIM WebSession Parser Enables Normalized API/Web Request Monitoringhttp://sentinelchangelog.net/posts/2026-06-09-pr-14424/Tue, 09 Jun 2026 20:35:40 +0000http://sentinelchangelog.net/posts/2026-06-09-pr-14424/ASIM WebSession parser for Salesforce Service Cloud normalizes API and web session logs into standardized schema, enabling unified monitoring across SaaS platforms.ASIM Schema Testing: EventProduct and EventVendor Enumerations Removedhttp://sentinelchangelog.net/posts/2026-06-08-pr-14433/Mon, 08 Jun 2026 22:34:01 +0000http://sentinelchangelog.net/posts/2026-06-08-pr-14433/Removes vendor/product enumerations from ASimTester configuration to reduce maintenance overhead.ASIM Parser Testing: Bitdefender GravityZone Validation Conflict Resolvedhttp://sentinelchangelog.net/posts/2026-06-08-pr-14411/Mon, 08 Jun 2026 21:41:50 +0000http://sentinelchangelog.net/posts/2026-06-08-pr-14411/Removes duplicate CustomFunction test shim causing KQL validation failures after parser merge.SAP Solution: Analyzer Marketplace Visibility and Agentless Connector Discovery Fixedhttp://sentinelchangelog.net/posts/2026-06-05-pr-14395/Fri, 05 Jun 2026 16:44:46 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-14395/Tools fixes enable proper SAP solution marketplace tracking and make the SAPCC agentless connector visible to the Microsoft Sentinel Solutions Analyzer.Check Point ASIM NetworkSession Parser: DeviceVendor Field Matching Fixhttp://sentinelchangelog.net/posts/2026-06-05-pr-13776/Fri, 05 Jun 2026 08:25:24 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-13776/Check Point firewall ASIM parser updated to handle both “Check Point” and “CheckPoint” DeviceVendor field values, fixing parsing failures introduced in PR #12056.ASIM Authentication Parsers: Palo Alto Data Fidelity Fix for DvcIpAddr Fieldhttp://sentinelchangelog.net/posts/2026-06-02-pr-14396/Tue, 02 Jun 2026 21:22:50 +0000http://sentinelchangelog.net/posts/2026-06-02-pr-14396/ASIM Authentication parsers for Palo Alto PAN-OS and GlobalProtect now correctly populate DvcIpAddr field, fixing data fidelity gap.ASIM Parser Development Automation: GitHub Copilot Skills for Accelerated Detection Engineeringhttp://sentinelchangelog.net/posts/2026-05-29-pr-14383/Fri, 29 May 2026 23:39:29 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14383/GitHub Copilot agent skills now automate the complete ASIM parser creation workflow, reducing parser development time from days to hours for security engineers.Bitdefender GravityZone Solution v3.0.1 Adds Incident Analytics for Endpoint and Email Protectionhttp://sentinelchangelog.net/posts/2026-05-28-pr-13299/Thu, 28 May 2026 05:19:38 +0000http://sentinelchangelog.net/posts/2026-05-28-pr-13299/Complete Microsoft Sentinel solution integrating Bitdefender GravityZone multi-vector threat detection with DCR-based ingestion and XDR correlation.ASIM AlertEvent Support Added for Bitdefender GravityZone Security Platformhttp://sentinelchangelog.net/posts/2026-05-28-pr-13330/Thu, 28 May 2026 05:16:16 +0000http://sentinelchangelog.net/posts/2026-05-28-pr-13330/New parsers enable normalization of Bitdefender GravityZone alert data into Microsoft Sentinel ASIM schema for unified threat detection.Hunting Query: Rootkit Network Evasion Detection via Firewall-EDR Telemetry Deltahttp://sentinelchangelog.net/posts/2026-05-27-pr-14337/Wed, 27 May 2026 08:36:31 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14337/New hunting query detects kernel-level rootkits bypassing EDR network telemetry by comparing perimeter firewall logs against Microsoft Defender for Endpoint data streams.ASIM AssetEntity Schema: Three New Fields Added in v1.0.0 Releasehttp://sentinelchangelog.net/posts/2026-05-26-pr-14312/Tue, 26 May 2026 08:18:37 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14312/ASIM AssetEntity schema upgraded to v1.0.0 with three new fields for enhanced entity correlation and snapshot tracking.OpenAI Connector: Migration to ASIM Standard Improves AI Monitoring Normalizationhttp://sentinelchangelog.net/posts/2026-05-20-pr-14277/Wed, 20 May 2026 22:32:31 +0000http://sentinelchangelog.net/posts/2026-05-20-pr-14277/OpenAI chat completions data now ingests to ASimAgentEventLogs standard table, enabling standardized AI usage monitoring and cross-product correlation.VMware ESXi: ASIM Authentication Parser for Host Access Monitoringhttp://sentinelchangelog.net/posts/2026-05-13-pr-13989/Wed, 13 May 2026 20:30:09 +0000http://sentinelchangelog.net/posts/2026-05-13-pr-13989/New ASIM parser normalizes VMware ESXi authentication events to enable centralized logon monitoring for hypervisor infrastructure.Cisco Secure Endpoint: ASIM AlertEvent Parser for Cloud-Based Threat Detectionhttp://sentinelchangelog.net/posts/2026-05-13-pr-13741/Wed, 13 May 2026 20:29:51 +0000http://sentinelchangelog.net/posts/2026-05-13-pr-13741/New ASIM parser enables normalized threat detection from Cisco Secure Endpoint via CCF ingestion to CiscoSecureEndpointEventsV2_CL table.NXLog Solutions Deprecated: Loss of Multi-Platform Audit Visibilityhttp://sentinelchangelog.net/posts/2026-05-11-pr-14228/Mon, 11 May 2026 22:20:53 +0000http://sentinelchangelog.net/posts/2026-05-11-pr-14228/Five NXLog partner solutions removed from Content Hub, eliminating data connector support for BSM macOS, FIM, Linux Audit, AIX Audit, and DNS monitoring across Unix/Linux environments.M365 Defender ASIM Parser: TargetUserSessionId Field Restoration Fixes Data Fidelity Gaphttp://sentinelchangelog.net/posts/2026-05-06-pr-14183/Wed, 06 May 2026 17:39:52 +0000http://sentinelchangelog.net/posts/2026-05-06-pr-14183/Missing TargetUserSessionId field in Microsoft 365 Defender ASIM ProcessEvent parsers has been restored, fixing queries that previously returned null for this session correlation field.VMware vCenter ASIM Parser: DvcId Type Correction Prevents Query Failureshttp://sentinelchangelog.net/posts/2026-05-05-pr-14182/Tue, 05 May 2026 23:34:50 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14182/Fixed critical data type mismatch in VMware vCenter authentication parser that caused DvcId field queries to fail.ASIM Agent Event Schema: New Normalization Framework for Security Agent Monitoringhttp://sentinelchangelog.net/posts/2026-04-24-pr-14086/Fri, 24 Apr 2026 22:19:31 +0000http://sentinelchangelog.net/posts/2026-04-24-pr-14086/Microsoft Sentinel gains ASIM Agent Event schema for normalizing security agent events across all vendor platforms.Halcyon Anti-Ransomware: Connector Overhaul from ASIM to OCSF Schema Architecturehttp://sentinelchangelog.net/posts/2026-04-23-pr-13928/Thu, 23 Apr 2026 06:33:39 +0000http://sentinelchangelog.net/posts/2026-04-23-pr-13928/Halcyon connector migrated from direct ASIM ingestion to OCSF schema with ASIM transformation parsers, replacing 5 custom tables with unified HalcyonEvents_CL table.Microsoft 365 Defender Process Parsers: Enhanced File Metadata Visibilityhttp://sentinelchangelog.net/posts/2026-04-22-pr-13785/Wed, 22 Apr 2026 16:54:39 +0000http://sentinelchangelog.net/posts/2026-04-22-pr-13785/ASIM Process Event parsers for Microsoft 365 Defender now extract file version metadata, improving process attribution and hunt query precision.ASIM Process Event Parsers: Parameter Standardization Fixes Filtering Logic Inconsistencieshttp://sentinelchangelog.net/posts/2026-04-17-pr-13932/Fri, 17 Apr 2026 23:03:12 +0000http://sentinelchangelog.net/posts/2026-04-17-pr-13932/ASIM Process Event parser parameter names corrected to match documentation, fixing filtering logic discrepancies that could affect query performance and parser interoperability.Cisco ISE ASIM Parser: Correcting IP Address Field Mappingshttp://sentinelchangelog.net/posts/2026-04-15-pr-14076/Wed, 15 Apr 2026 21:31:51 +0000http://sentinelchangelog.net/posts/2026-04-15-pr-14076/Cisco ISE Administrator authentication parser fixes swap incorrect SrcIpAddr and TargetIpAddr mappings that broke network forensics queries.VMware vCenter ASIM Parser: Fixing Field Mappings After ASIM Schema Updateshttp://sentinelchangelog.net/posts/2026-04-15-pr-14075/Wed, 15 Apr 2026 21:28:01 +0000http://sentinelchangelog.net/posts/2026-04-15-pr-14075/Critical fixes to VMware vCenter authentication parser resolve incorrect field mappings that broke queries referencing User and DvcId fields.ASIM Authentication: New Parser for Cisco ISE Administrator Login Eventshttp://sentinelchangelog.net/posts/2026-04-10-pr-13909/Fri, 10 Apr 2026 21:15:53 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-13909/Added ASIM Authentication parser for Cisco ISE administrator authentication events, expanding centralized network device visibility.Fortinet FortiGate ASIM Authentication Parsers: Schema Version Metadata Correctionhttp://sentinelchangelog.net/posts/2026-04-10-pr-14041/Fri, 10 Apr 2026 17:19:19 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-14041/Updates schema version metadata from 0.1.3 to 0.1.4 in FortiGate authentication parsers with no functional changes.Cisco Umbrella ASIM Parser: Fixing Variable Scope Bug in IP Filter Logichttp://sentinelchangelog.net/posts/2026-04-09-pr-14027/Thu, 09 Apr 2026 20:15:05 +0000http://sentinelchangelog.net/posts/2026-04-09-pr-14027/Moves critical IP filtering variables inside parser function to prevent incorrect filtering and potential data loss.Palo Alto GlobalProtect: New ASIM Authentication Parser for VPN Monitoringhttp://sentinelchangelog.net/posts/2026-04-09-pr-14012/Thu, 09 Apr 2026 16:00:52 +0000http://sentinelchangelog.net/posts/2026-04-09-pr-14012/New ASIM parser normalizes GlobalProtect VPN authentication events from CommonSecurityLog table, enabling unified monitoring of gateway and portal authentication across Palo Alto PAN-OS deployments.