Microsoft Sentinel
Cloud and workloadsNormalization Create Parsers Ai Agent
In brief
The documentation now states that parser creation skills normalize each source record independently and preserve record cardinality. Query-local datatable/lookup mappings are allowed when lookup keys are unique, while same-table and cross-table event enrichment are not used.
What Defender admins need to know
Administrators creating parsers should use unique lookup keys and plan for record-by-record normalization. No required configuration change is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Builds the parser - Creates a KQL function that transforms source data into the target ASIM schema, mapping source columns to ASIM fields using high-performance parsing operators (
split,parse-kv,parse). - Saves the parser - Outputs a file named
ASim<Schema><Vendor><Product>.kqland verifies it runs without syntax errors.
Validation
The asim-parser-validator skill runs two validations against the parser:
@@ -4,7 +4,7 @@ description: Use GitHub Copilot or the Microsoft Sentinel VS Code extension skil ms.author: derricklee author: derricklee ms.topic: how-to-ms.date: 07/15/2026+ms.date: 09/07/2026 ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1012 @@ -91,6 +91,9 @@ The `asim-parser-create-parser` skill generates the initial parameter-less ASIM 1. **Builds the parser** - Creates a KQL function that transforms source data into the target ASIM schema, mapping source columns to ASIM fields using high-performance parsing operators (`split`, `parse-kv`, `parse`). 1. **Saves the parser** - Outputs a file named `ASim<Schema><Vendor><Product>.kql` and verifies it runs without syntax errors. +> [!IMPORTANT]+> The parser creation skills normalize each source record independently and preserve record cardinality. Query-local static mappings created with `datatable` and applied with `lookup` are allowed when each lookup key is unique. The skills don't use same-table or cross-table event enrichment, one-to-many fan-out, `mv-*` operators, or event-record aggregation and reaggregation operators such as `summarize`. If a field requires one of these prohibited patterns, correct the connector or source event shape, or leave a nonmandatory field unmapped. For detailed guidance, see [Develop ASIM parsers](/azure/sentinel/normalization-develop-parsers#keep-parser-operations-record-local).+ ### Validation The `asim-parser-validator` skill runs two validations against the parser: