ASIM
The Advanced Security Information Model is Microsoft Sentinel's normalization standard. It defines a set of schemas, each covering one class of security event, so that analytics rules and queries can be written once and run across every source that normalizes to them.
DataStream converts to ASIM with the Normalize processor, writing the schema version into the EventSchemaVersion field of each event.
Available ASIM Tables
Each schema is versioned independently by Microsoft. The versions below are the ones DataStream emits.
| Table | Schema Version | Description |
|---|---|---|
ASimAuditEventLogs | 0.1 | Audit events and administrative actions |
ASimAuthenticationEventLogs | 0.1.3 | Authentication and logon events |
ASimDhcpEventLogs | 0.1 | DHCP address assignment events |
ASimDnsActivityLogs | 0.1.7 | DNS query and response events |
ASimFileEventLogs | 0.2.1 | File system activity events |
ASimNetworkSessionLogs | 0.2.6 | Network connection and session events |
ASimProcessEventLogs | 0.1.4 | Process creation and termination events |
ASimRegistryEventLogs | 0.1.2 | Windows registry modification events |
ASimUserManagementActivityLogs | 0.1 | User account management events |
ASimWebSessionLogs | 0.2.6 | Web browsing and HTTP session events |