Process Terminate Event ASIM parser for Microsoft Windows Security Events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimProcessEventTerminateMicrosoftSysmon |
| Built-in Parser | _ASim_ProcessEvent_TerminateMicrosoftSysmon |
| Schema | ProcessEvent |
| Schema Version | 0.1.4 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Microsoft Windows Events Sysmon |
| Parser Version | 0.3.1 (version history) |
| Last Updated | Jun 3, 2024 |
| Unifying Parser | ASimProcessEvent, ASimProcessEventTerminate |
| Source File | Parsers\ASimProcessEvent\Parsers\ASimProcessTerminateMicrosoftSysmon.yaml |
Description
This ASIM parser supports normalizing Microsoft Windows Sysmon process terminate events (event 5) collected using the Event or WEF (WindowsEvent table) connectors logs ingested in 'Event' table to the ASIM Process Event normalized schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
Event |
EventID == "5"Source == "Microsoft-Windows-Sysmon" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊