File event ASIM parser for Windows Sysmon
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimFileEventMicrosoftSysmonWindowsEvent |
| Built-in Parser | _ASim_FileEvent_MicrosoftSysmonWindowsEvent |
| Schema | FileEvent |
| Schema Version | 0.2.1 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Windows Sysmon |
| Parser Version | 0.4.1 (version history) |
| Last Updated | Jul 19, 2024 |
| Unifying Parser | ASimFileEvent |
| Source File | Parsers\ASimFileEvent\Parsers\ASimFileEventMicrosoftSysmonWindowsEvent.yaml |
Description
This ASIM parser supports normalizing Sysmon logs ingested in 'WindowsEvent' table to the ASIM file event schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
WindowsEvent |
EventID in "11,23,26"Provider == "Microsoft-Windows-Sysmon" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
| Connector | Solution |
|---|---|
| WindowsForwardedEvents | Windows Forwarded Events |
Solutions: Windows Forwarded Events
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊