Registry Event ASIM parser for Microsoft Sysmon (registry creation event)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimRegistryEventMicrosoftSysmonWindowsEvent |
| Built-in Parser | _ASim_RegistryEvent_MicrosoftSysmonWindowsEvent |
| Schema | RegistryEvent |
| Schema Version | 0.1.2 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Microsoft Sysmon |
| Parser Version | 0.3.1 (version history) |
| Last Updated | Jun 18, 2024 |
| Unifying Parser | ASimRegistry |
| Source File | Parsers\ASimRegistryEvent\Parsers\ASimRegistryEventMicrosoftSysmonWindowsEvent.yaml |
Description
This ASIM parser supports normalizing Microsoft Sysmon events (event number 12, 13, 14) logs ingested in 'WindowsEvent' table to the ASIM Registry Event normalized schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
WindowsEvent |
EventID in "12,13,14"Provider == "Microsoft-Windows-Sysmon" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
| Connector | Solution |
|---|---|
| WindowsForwardedEvents | Windows Forwarded Events |
Solutions: Windows Forwarded Events
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊