Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Normalization Manage Parsers

4 September 2026Doc update+8 / −8 lines

In brief

The page now provides clearer links to architecture, deployment instructions, and the ASIM watchlist template. It also clarifies filtering and parameter-less custom parsers, parser union behavior, and watchlist-based exclusion of built-in parsers.

What Defender admins need to know

Administrators can use the revised references and guidance when deploying or modifying ASIM parsers. No administrator action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

#Customer intent: As a security analyst, I want to manage and customize ASIM parsers so that I can normalize and analyze security data from various sources effectively.

Advanced Security Information Model (ASIM) users use unifying parsers instead of table names in their queries, to view data in a normalized format and get all the data relevant to the schema in a single query. Each unifying parser uses multiple source-specific parsers that handle each source's specific details.

To understand how parsers fit within the ASIM architecture, refer to the ASIM components section in the ASIM architecture diagram.

You may need to manage the source-specific parsers used by each unifying parser to:

The procedures in this article assume that all source-specific parsers have already been deployed to your Microsoft Sentinel workspace.

For more information,deployment instructions, see the Deploy parsers section in Develop ASIM parsers.

Manage built-in unifying parsers

  • To support excluding built-in source-specific parsers, ASIM uses a watchlist. Deploy the watchlist to your Microsoft Sentinel workspace from the Microsoft Sentinel ASIM watchlist deployment template on GitHub.

  • To define source type for built-in and custom parsers, ASIM uses a watchlist. Deploy the watchlist to your Microsoft Sentinel workspace from the Microsoft Sentinel ASIM watchlist deployment template repository.on GitHub.

Add a custom parser to a built-in unifying parser

To add a custom parser, insert a line to the custom unifying parser to reference the new, custom parser.

Make sure to add both a filtering custom parser (one that accepts filtering parameters to optimize performance) and a parameter-less custom parser.parser (one that returns all results without filtering parameters). To learn more about how to edit parsers, refer to the document Functions in Azure Monitor log queries.

The syntax of the line to add is different for each schema:

When adding an additional parser to a unifying custom parser that already references parsers, make sure you add a comma at the end of the previous line.

For example, the following code shows a custom unifying parser after adding added_parser. The union isfuzzy=true statement combines results from both the existing and the new custom parser,parser so that both contribute to the normalized output, tolerating minor schema differences between them:

union isfuzzy=true
  - A record with `Any` as the `SourceSpecificParser` field, to exclude all parsers for the `CallerContext`.
  - A record for  `Any` in the CallerContext and the `SourceSpecificParser` fields to exclude all built-in parsers.

  For more information,details on excluding built-in parsers using the watchlist, see the [Use a modified version of a built-in parser](#use-a-modified-version-of-a-built-in-parser). section.

## Configure the sources relevant to a source-specific parser