ASIM AuditEvent Parser: Azure SQL Security Audit Data Normalized for Detection
New ASIM parser enables normalized analysis of SQL security audit events from SQLSecurityAuditEvents and AzureDiagnostics tables. Read More →
ASIM
ASIM Schema Standardization: Removing Unused User Role Fields Across Multiple Schemas
Cleanup of unused Actor/Target user role fields and alignment of empty parsers improves schema consistency but does not affect active detection capabilities. Read More →
ASIM Schema Cleanup: Removing Unused User Fields from Test Configuration
Maintenance cleanup removes unused optional user fields from ASIM test configuration with no impact on parser or detection functionality. Read More →
ASIM Authentication: New Okta OktaSystemLogs Parser Enables Normalized Identity Event Analysis
New ASIM parser normalizes Okta authentication events from OktaSystemLogs table to standard Authentication schema. Read More →
FortiGate ASIM Authentication Parser: New Visibility for Fortinet Administrative Access Events
New ASIM parser adds normalised authentication monitoring for FortiGate administrator login and logout events. Read More →
Azure Key Vault ASIM Parser: New Audit Event Normalization for Critical Key Management Monitoring
Azure Key Vault audit events can now be analyzed using ASIM schema, enabling standardized detection across vault, secret, key, and certificate operations. Read More →
ASIM Asset Entity Schema: New Schema Foundation for Asset Management
Introduces complete ASIM Asset Entity schema with parsers, empty templates, and CI integration to enable asset-centric security monitoring. Read More →
Cyera DSPM Connector: Critical DCR Transform Fix Restores Asset Visibility After KQL Function Errors
Cyera DSPM connector v3.0.4 fixes DCR transformation failures that prevented data ingestion, restoring visibility into cloud asset security posture and compliance. Read More →
ASIM Registry Event: Added Mandatory Fields for Microsoft 365 Defender Parser Compliance
Updated ASIM Registry Event parser for Microsoft 365 Defender to include mandatory EventSchema and EventResult fields per schema compliance requirements. Read More →
Solutions Analyzer Tools: Kusto Upload, CCF Legacy Support, and Parser Analysis Enhancements
Major tooling update adds Kusto integration, improves CCF connector classification, and fixes ASIM parser documentation generation. Read More →
ASIM FileEvent Parser: New AWS CloudTrail S3 Support Added
New FileEvent parser enables normalized S3 object activity monitoring from AWS CloudTrail logs across bucket operations and object lifecycle events. Read More →
Threat Intelligence: URL IOC Detection Added for Web Session Monitoring
New Analytic Rule enables detection of malicious URLs from threat feeds in web traffic, closing coverage gap for URL-based indicators. Read More →
ASIM User Management: AWS CloudTrail Parser Enables IAM and Cognito Visibility
New ASIM parser normalizes AWS CloudTrail user management events from IAM and Cognito services into Microsoft Sentinel. Read More →
ASIM Authentication Schema: NetworkCleartext SubType Added
ASIM Authentication schema expanded to include NetworkCleartext authentication subtype for cleartext password events. Read More →
ASIM AlertEvent: Microsoft Defender XDR Parser Enhanced with Improved Field Mappings
Microsoft Defender XDR AlertEvent parsers updated with optimized KQL logic, corrected field mappings, and enhanced IP address collection. Read More →
ASIM Sudo Authentication Parser: Schema Version 0.1.4 Compliance and Field Mapping Enhancements
ASIM sudo parser updated to schema 0.1.4 with improved field mappings, severity normalization, and code deduplication. Read More →
ASIM SSH Authentication Parser: Improved Invalid User Event Parsing
OpenSSH authentication parser now correctly extracts source IP addresses from “Invalid user” events regardless of port format. Read More →
ASIM Authentication Parser: Linux Su Command Enhanced with Failed Authentication Support
Linux su parser significantly enhanced to capture failed su attempts, correct event classification from Elevation to Logon, and improve field mappings for comprehensive privilege escalation monitoring. Read More →
ASIM Authentication Parser: Palo Alto Cortex Data Lake Performance and Schema Fixes
Palo Alto Cortex Data Lake authentication parser enhanced with schema compliance improvements, performance optimizations, and corrected field mappings for better data fidelity. Read More →
ASIM Authentication Parser: Microsoft 365 Defender Schema Compliance Enhancement
Microsoft 365 Defender authentication parser improved ASIM compliance by removing unnormalized columns and relocating process/hash metadata to AdditionalFields structure. Read More →