Authentication ASIM parser for Palo Alto Cortex Data Lake
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimAuthenticationPaloAltoCortexDataLake |
| Built-in Parser | _ASim_Authentication_PaloAltoCortexDataLake |
| Schema | Authentication |
| Schema Version | 0.1.3 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Palo Alto Cortex Data Lake |
| Parser Version | 0.2.0 (version history) |
| Last Updated | Jan 08, 2026 |
| Unifying Parser | ASimAuthentication |
| Source File | Parsers\ASimAuthentication\Parsers\ASimAuthenticationPaloAltoCortexDataLake.yaml |
Description
This ASIM parser supports normalizing Palo Alto Cortex Data Lake logs to the ASIM Authentication normalized schema. These events are captured through the Palo Alto Networks CDL data connector that ingests CDL logs into Microsoft Sentinel.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID == "AUTH"DeviceProduct == "LF"DeviceVendor == "Palo Alto Networks" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, VirtualMetric DataStream, Zscaler Internet Access
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊