Process Terminate Event ASIM parser for Windows Security Events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimProcessTerminateMicrosoftSecurityEvents |
| Built-in Parser | _ASim_ProcessEvent_TerminateMicrosoftSecurityEvents |
| Schema | ProcessEvent |
| Schema Version | 0.1.0 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Security Events |
| Parser Version | 0.2 (version history) |
| Last Updated | May 1st 2023 |
| Unifying Parser | ASimProcessEvent, ASimProcessEventTerminate |
| Source File | Parsers\ASimProcessEvent\Parsers\ASimProcessTerminateMicrosoftSecurityEvents.yaml |
Description
This ASIM parser supports normalizing Windows process terminate events (event 4689) collected using the Security Events connectors, utilizing either the Log Analytics agent or the Azure Monitor Agent (AMA) and stored in the SecurityEvent table to the ASIM Process Event normalized schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
EventID == "4689" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
| Connector | Solution |
|---|---|
| WindowsSecurityEvents | Windows Security Events |
Solutions: Windows Security Events
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊