Microsoft Sentinel
Cloud and workloadsNormalization
In brief
The page now links to the Agent Event schema and documents the Asset Entity schema for normalizing asset inventories and change feeds. The page date was also updated.
What Defender admins need to know
Administrators can more easily find guidance for normalizing agent-event and asset-inventory data; no action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
#Customer intent: As a security analyst, I want to use the Advanced Security Information Model (ASIM) so that I can normalize and correlate data from diverse sources for more efficient threat detection and investigation.
ASIM currently defines the following schemas:
ASIM also defines the Asset Entity schema for normalizing asset inventories and change feeds.
For more information, see ASIM schemas.
Query time parsers
@@ -5,7 +5,7 @@ ms.author: edbaynash author: EdB-MSFT ms.reviewer: vakohl ms.topic: concept-article-ms.date: 09/26/2024+ms.date: 08/07/2026 #Customer intent: As a security analyst, I want to use the Advanced Security Information Model (ASIM) so that I can normalize and correlate data from diverse sources for more efficient threat detection and investigation.@@ -61,6 +61,7 @@ Normalized schemas cover standard sets of predictable event types that you can u ASIM currently defines the following schemas: +- [Agent Event](normalization-schema-agent.md) - [Alert Event](normalization-schema-alert.md) - [Audit Event](normalization-schema-audit.md) - [Authentication Event](normalization-schema-authentication.md)@@ -73,6 +74,8 @@ ASIM currently defines the following schemas: - [User Management](normalization-schema-user-management.md) - [Web Session](normalization-schema-web.md) +ASIM also defines the [Asset Entity](normalization-schema-asset.md) schema for normalizing asset inventories and change feeds.+ For more information, see [ASIM schemas](normalization-about-schemas.md). ### Query time parsers