Microsoft Sentinel
Cloud and workloadsModify content to use the Advanced Security Information Model (ASIM)
In brief
The page metadata was updated, and a new section titled “Convert Microsoft Sentinel content to use ASIM normalized data” was added.
What Defender admins need to know
No administrator action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#Customer intent: As a security analyst, I want to modify custom analytics rules to use the Advanced Security Information Model (ASIM) so that I can leverage normalized data for more efficient and consistent threat detection.
Modify content to use the Advanced Security Information Model (ASIM)
Convert Microsoft Sentinel content to use ASIM normalized data
Normalized security content in Microsoft Sentinel includes analytics rules, hunting queries, and workbooks that work with unifying normalization parsers.
You can find normalized, out-of-the-box content in Microsoft Sentinel galleries and Microsoft Sentinel solutions catalog, create your own normalized content, or modify existing, custom content to use normalized data.
@@ -4,9 +4,9 @@ description: Learn how to convert existing Microsoft Sentinel analytics rules to ms.author: edbaynash author: EdB-MSFT ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/01/2026 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security analyst, I want to modify custom analytics rules to use the Advanced Security Information Model (ASIM) so that I can leverage normalized data for more efficient and consistent threat detection.@@ -15,6 +15,8 @@ ms.custom: msecd-doc-authoring-1014 # Modify content to use the Advanced Security Information Model (ASIM) +## Convert Microsoft Sentinel content to use ASIM normalized data+ Normalized security content in Microsoft Sentinel includes analytics rules, hunting queries, and workbooks that work with unifying normalization parsers. <a name="builtin"></a>You can find normalized, out-of-the-box content in Microsoft Sentinel galleries and [Microsoft Sentinel solutions catalog](sentinel-solutions-catalog.md), create your own normalized content, or modify existing, custom content to use normalized data.