Authentication ASIM parser for Palo Alto PAN-OS
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimAuthenticationPaloAltoPanOS |
| Built-in Parser | _ASim_Authentication_PaloAltoPanOS |
| Schema | Authentication |
| Schema Version | 0.1.4 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Palo Alto PAN-OS |
| Parser Version | 0.1.0 (version history) |
| Last Updated | Apr 02, 2026 |
| Unifying Parser | ASimAuthentication |
| Source File | Parsers\ASimAuthentication\Parsers\ASimAuthenticationPaloAltoPanOS.yaml |
Description
This ASIM parser supports normalizing Palo Alto PAN-OS authentication logs to the ASIM Authentication normalized schema. These events are captured through the Palo Alto Networks CEF data connector that ingests PAN-OS logs into Microsoft Sentinel via CommonSecurityLog.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID startswith "auth"DeviceProduct == "PAN-OS"DeviceVendor == "Palo Alto Networks" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
pack |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, VirtualMetric DataStream, Zscaler Internet Access
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊