Normalization and the Advanced SIEM Information Model (ASIM) (Public preview)
Note
Azure Sentinel is now called Microsoft Sentinel, and we’ll be updating these pages in the coming weeks. Learn more about recent Microsoft security enhancements.
Microsoft Sentinel ingests data from many sources. Working with various data types and tables together requires you to understand each of them, and write and use unique sets of data for analytics rules, workbooks, and hunting queries for each type or schema.
Sometimes, you'll need separate rules, workbooks, and queries, even when data types share common elements, such as firewall devices. Correlating between different types of data during an investigation and hunting can also be challenging.
This article provides an overview of the Advanced Security Information and Event Management (SIEM) Information Model (ASIM), which provides a solution for the challenges of handling multiple types of data.
Tip
Also watch the ASIM Webinar or review the webinar slides. For more information, see Next steps.
Important
ASIM is currently in PREVIEW. The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
Common ASIM usage
The Advanced SIEM Information Model (ASIM) provides a seamless experience for handling various sources in uniform, normalized views, by providing the following functionality:
Cross source detection. Normalized analytics rules work across sources, on-premises and cloud, and detect attacks such as brute force or impossible travel across systems, including Okta, AWS, and Azure.
Source agnostic content. The coverage of both built-in and custom content using ASIM automatically expands to any source that supports ASIM, even if the source was added after the content was created. For example, process event analytics support any source that a customer may use to bring in the data, such as Microsoft Defender for Endpoint, Windows Events, and Sysmon.
Support for your custom sources, in built-in analytics
Ease of use. After an analyst learns ASIM, writing queries is much simpler as the field names are always the same.
ASIM and the Open Source Security Events Metadata
The Advanced SIEM Information Model aligns with the Open Source Security Events Metadata (OSSEM) common information model, allowing for predictable entities correlation across normalized tables.
OSSEM is a community-led project that focuses primarily on the documentation and standardization of security event logs from diverse data sources and operating systems. The project also provides a Common Information Model (CIM) that can be used for data engineers during data normalization procedures to allow security analysts to query and analyze data across diverse data sources.
For more information, see the OSSEM reference documentation.
ASIM components
The following image shows how non-normalized data can be translated into normalized content and used in Microsoft Sentinel. For example, you can start with a custom, product-specific, non-normalized table, and use a parser and a normalization schema to convert that table to normalized data. Use your normalized data in both Microsoft and custom analytics, rules, workbooks, queries, and more.
The Advanced SIEM Information Model includes the following components:
| Component | Description |
|---|---|
| Normalized schemas | Cover standard sets of predictable event types that you can use when building unified capabilities. Each schema defines the fields that represent an event, a normalized column naming convention, and a standard format for the field values. ASIM currently defines the following schemas: - Authentication Event - DHCP Activity - DNS Activity - File Activity - Network Session - Process Event - Registry Event - Web Session For more information, see Advanced SIEM Information Model schemas. |
| Parsers | Map existing data to the normalized schemas using KQL functions. Deploy the Microsoft-developed normalizing parsers from the Parsers folder in the Microsoft Sentinel GitHub repository. For more information, see Advanced SIEM Information Model parsers. |
| Content for each normalized schema | Includes analytics rules, workbooks, hunting queries, and more. Content for each normalized schema works on any normalized data without the need to create source-specific content. For more information, see Advanced SIEM Information Model content. |
ASIM terminology
The Advanced SIEM Information Model uses the following terms:
| Term | Description |
|---|---|
| Reporting device | The system that sends the records to Microsoft Sentinel. This system may not be the subject system for the record that's being sent. |
| Record | A unit of data sent from the reporting device. A record is often referred to as log, event, or alert, but can also be other types of data. |
| Content, or Content Item | The different, customizable, or user-created artifacts than can be used with Microsoft Sentinel. Those artifacts include, for example, Analytics rules, Hunting queries and workbooks. A content item is one such artifact. |
Getting started with ASIM
To start using ASIM:
Deploy all ASIM parsers quickly from the Microsoft Sentinel GitHub repository.
Activate analytics rule templates that use ASIM. For more information, see the Advanced SIEM Information Model (ASIM) content list.
Use ASIM in your workspace, using the following methods:
Use the ASIM hunting queries from the Microsoft Sentinel GitHub repository, when querying logs in KQL in the Microsoft Sentinel Logs page. For more information, see the Advanced SIEM Information Model (ASIM) content list.
Write your own analytics rules using ASIM or convert existing ones.
Enable your custom data to use built-in analytics by writing parsers for your custom sources and adding them to the relevant source agnostic parser.
Next steps
This article provides an overview of normalization in Microsoft Sentinel and the Advanced SIEM Information Model.
For more information, see: