{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/", "slug": "dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation", "url": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/" }, "title": "Keep ASIM parser normalization separate from event correlation", "summary": "Can a custom ASIM parser join, expand or aggregate event records while normalizing them?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:56+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 252, "potentially_affected": "Custom source-specific Advanced Security Information Model parsers in Microsoft Sentinel.", "dse_recommendation": "Review each parser operation against a zero-or-one output record contract before adding enrichment or correlation.", "primary_source": { "name": "Develop Microsoft Sentinel Advanced Security Information Model (ASIM) parsers | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/sentinel/isv/normalization-develop-parsers", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s ASIM development guidance requires independent normalization of each source record, producing either no record after filtering or one normalized record. It prohibits event joins, extra table reads, watchlists, external tabular enrichment, expansion and event aggregation inside the parser. A locally defined static mapping used with lookup is allowed only with unique keys. When one source record contains several logical events, the guidance calls for correcting the source or connector rather than expanding it in the parser. Microsoft Learn.

\n

Applicability

\n

Apply this contract to a source-specific ASIM parser under development or review. Do not treat an arbitrary analytical KQL query as an appropriate normalization function merely because its final columns resemble the schema.

\n

DSE recommendation

\n

Review each parser operation against a zero-or-one output record contract before adding enrichment or correlation. Ask the connector owner to resolve missing source identity or bundled event shapes at their origin. Keep detection-stage correlation outside the normalization implementation. For a permitted static mapping, review key uniqueness alongside the field mapping so an apparently simple lookup does not obscure the intended record relationship.

\n

Verification

\n

Use representative source samples with different outcomes and identifier formats. Trace each retained output to its individual input and account for intentional filtering. Include duplicate mapping-key and bundled-event cases in the design review, recording how they are corrected rather than silently accepted. Preserve both schema checks and record-count evidence; correctly named columns alone do not demonstrate that the parser preserves event identity.

\n

Official references

\n

Microsoft Learn: Develop ASIM parsers. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMicrosoft’s ASIM development guidance requires independent normalization of each source record, producing either no record after filtering or one normalized record. It prohibits event joins, extra table reads, watchlists, external tabular enrichment, expansion and event aggregation inside the parser. A locally defined static mapping used with lookup is allowed only with unique keys. When one source record contains several logical events, the guidance calls for correcting the source or connector rather than expanding it in the parser. Microsoft Learn.\nApplicability\nApply this contract to a source-specific ASIM parser under development or review. Do not treat an arbitrary analytical KQL query as an appropriate normalization function merely because its final columns resemble the schema.\nDSE recommendation\nReview each parser operation against a zero-or-one output record contract before adding enrichment or correlation. Ask the connector owner to resolve missing source identity or bundled event shapes at their origin. Keep detection-stage correlation outside the normalization implementation. For a permitted static mapping, review key uniqueness alongside the field mapping so an apparently simple lookup does not obscure the intended record relationship.\nVerification\nUse representative source samples with different outcomes and identifier formats. Trace each retained output to its individual input and account for intentional filtering. Include duplicate mapping-key and bundled-event cases in the design review, recording how they are corrected rather than silently accepted. Preserve both schema checks and record-count evidence; correctly named columns alone do not demonstrate that the parser preserves event identity.\nOfficial references\nMicrosoft Learn: Develop ASIM parsers. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft’s ASIM development guidance requires independent normalization of each source record, producing either no record after filtering or one normalized record. It prohibits event joins, extra table reads, watchlists, external tabular enrichment, expansion and event aggregation inside the parser. A locally defined static mapping used with lookup is allowed only with unique keys. When one source record contains several logical events, the guidance calls for correcting the source or connector rather than expanding it in the parser. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/sentinel/isv/normalization-develop-parsers).\n\n## Applicability\n\nApply this contract to a source-specific ASIM parser under development or review. Do not treat an arbitrary analytical KQL query as an appropriate normalization function merely because its final columns resemble the schema.\n\n## DSE recommendation\n\nReview each parser operation against a zero-or-one output record contract before adding enrichment or correlation. Ask the connector owner to resolve missing source identity or bundled event shapes at their origin. Keep detection-stage correlation outside the normalization implementation. For a permitted static mapping, review key uniqueness alongside the field mapping so an apparently simple lookup does not obscure the intended record relationship.\n\n## Verification\n\nUse representative source samples with different outcomes and identifier formats. Trace each retained output to its individual input and account for intentional filtering. Include duplicate mapping-key and bundled-event cases in the design review, recording how they are corrected rather than silently accepted. Preserve both schema checks and record-count evidence; correctly named columns alone do not demonstrate that the parser preserves event identity.\n\n## Official references\n\n[Microsoft Learn: Develop ASIM parsers](https://learn.microsoft.com/en-us/azure/sentinel/isv/normalization-develop-parsers). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep ASIM parser normalization separate from event correlation", "item": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/", "headline": "Keep ASIM parser normalization separate from event correlation", "description": "Can a custom ASIM parser join, expand or aggregate event records while normalizing them?", "abstract": "Can a custom ASIM parser join, expand or aggregate event records while normalizing them?", "articleBody": "Source facts\nMicrosoft’s ASIM development guidance requires independent normalization of each source record, producing either no record after filtering or one normalized record. It prohibits event joins, extra table reads, watchlists, external tabular enrichment, expansion and event aggregation inside the parser. A locally defined static mapping used with lookup is allowed only with unique keys. When one source record contains several logical events, the guidance calls for correcting the source or connector rather than expanding it in the parser. Microsoft Learn.\nApplicability\nApply this contract to a source-specific ASIM parser under development or review. Do not treat an arbitrary analytical KQL query as an appropriate normalization function merely because its final columns resemble the schema.\nDSE recommendation\nReview each parser operation against a zero-or-one output record contract before adding enrichment or correlation. Ask the connector owner to resolve missing source identity or bundled event shapes at their origin. Keep detection-stage correlation outside the normalization implementation. For a permitted static mapping, review key uniqueness alongside the field mapping so an apparently simple lookup does not obscure the intended record relationship.\nVerification\nUse representative source samples with different outcomes and identifier formats. Trace each retained output to its individual input and account for intentional filtering. Include duplicate mapping-key and bundled-event cases in the design review, recording how they are corrected rather than silently accepted. Preserve both schema checks and record-count evidence; correctly named columns alone do not demonstrate that the parser preserves event identity.\nOfficial references\nMicrosoft Learn: Develop ASIM parsers. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:24:56+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-420-keep-asim-parser-normalization-separate-from-event-correlation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep ASIM parser normalization separate from event correlation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 252, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Develop Microsoft Sentinel Advanced Security Information Model (ASIM) parsers | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/sentinel/isv/normalization-develop-parsers" } } ] } }