DNS activity ASIM parser for Halcyon
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimDnsHalcyon |
| Built-in Parser | _ASim_Dns_Halcyon |
| Schema | Dns |
| Schema Version | 0.1.7 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Halcyon |
| Parser Version | 0.1.0 (version history) |
| Last Updated | Jun 09, 2026 |
| Unifying Parser | ASimDns |
| Source File | Parsers\ASimDns\Parsers\ASimDnsHalcyon.yaml |
Description
This ASIM parser supports normalizing Halcyon DNS activity events to the ASIM DNS normalized schema. These events are generated by Halcyon's DNS-based threat detection and ingested into the HalcyonEventsV2_CL table in Microsoft Sentinel.
Note: The HalcyonEventsV2_CL table must be configured on the Log Analytics workspace's Analytics plan to use this parser. The Basic Logs plan does not support invocation of user-defined functions, which is required for ASIM parser consumption.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
HalcyonEventsV2_CL |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
| Connector | Solution |
|---|---|
| HalcyonPushV2 | Halcyon |
Solutions: Halcyon
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊