Process Create Event ASIM parser for Microsoft 365 Defender for endpoint
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimProcessEventMicrosoft365D |
| Built-in Parser | _ASim_ProcessEvent_Microsoft365D |
| Schema | ProcessEvent |
| Schema Version | 0.1.4 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Microsoft 365 Defender for endpoint |
| Parser Version | 0.3.0 (version history) |
| Last Updated | Mar 10, 2026 |
| Unifying Parser | ASimProcessEvent, ASimProcessEventCreate, ASimProcessEventTerminate |
| Source File | Parsers\ASimProcessEvent\Parsers\ASimProcessEventMicrosoft365D.yaml |
Description
This ASIM parser supports normalizing Microsoft 365 Defender for endpoint to the ASIM Process Event normalized schema.
Source Tables
This parser reads from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
DeviceProcessEvents |
✓ | ✗ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊