File Event ASIM parser for Microsoft Windows Events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimFileEventMicrosoftSecurityEvents |
| Built-in Parser | _ASim_FileEvent_MicrosoftSecurityEvents |
| Schema | FileEvent |
| Schema Version | 0.2.1 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Microsoft Windows Events |
| Parser Version | 0.2.0 (version history) |
| Last Updated | Jul 23, 2024 |
| Unifying Parser | ASimFileEvent |
| Source File | Parsers\ASimFileEvent\Parsers\ASimFileEventMicrosoftSecurityEvents.yaml |
Description
This ASIM parser supports normalizing Microsoft Windows Events (WindowsEvent and SecurityEvent tables) logs ingested in 'SecurityEvent' table to the ASIM File Event normalized schema. Event IDs which are parsed as part of this parser: 4663
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
EventID == "4663" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
| Connector | Solution |
|---|---|
| WindowsSecurityEvents | Windows Security Events |
Solutions: Windows Security Events
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊