For the complete documentation index, see llms.txt. This page is also available as Markdown.

ASIM Standardization

The ASIM Standardization processor transforms logs into events that conform to the Microsoft Advanced Security Information Model (ASIM). It maps source-specific fields to the column contract of one of the native ASIM tables in a Microsoft Sentinel workspace, replaces the log body with the ASIM columns, and sets the sentinel_stream_name attribute the Microsoft Sentinel destination reads to route each record to the correct table. It operates on logs only.

Supported Telemetry

Metrics
Logs
Traces

Configuration

Bindplane docs - ASIM Standardization - image 1

General

Parameter
Type
Required
Default
Description

Choose Telemetry Type

Telemetry Selector

Yes

Logs

The signal this instance runs on. Logs only.

Prebuilt Mappings

Resource Preset

No

(empty)

Prebuilt event mappings for common log sources. Selected presets are added as Configure event mappings entries and can be edited after import.

Configure event mappings to transform logs into ASIM table rows.

ASIM Standardization

Yes

(empty)

One or more mappings that transform a matched log into an ASIM table row. The first mapping whose Filter matches is applied; if no mapping matches, the record is dropped. See Event mappings below.

Advanced

Parameter
Type
Required
Default
Description

Runtime Validation

Boolean

No

true

Validate every transformed record against the ASIM column contract. When enabled, the processor coerces each mapped field to its target type (string, datetime, int, long, real, boolean, dynamic) and drops records missing any ASIM common mandatory column. Disable to pass mapped records through unchanged.

Event mappings

Each event mapping defines how a matched log is transformed into one ASIM table row. Configure multiple mappings in a single processor to handle different log types.

Field
Type
Required
Default
Description

Target Table

Enum

Yes

The ASIM table to route matched records to, such as ASimAuthenticationEventLogs.

Filter

OTTL Condition

No

(empty)

A condition that selects which logs this mapping applies to. If omitted, the mapping applies to all logs.

Field Mappings

List

Yes

One row per ASIM column to populate. See Field mappings below.

Field mappings

Each field-mapping row populates a single ASIM column.

Field
Type
Required
Default
Description

To

String

Yes

The target ASIM column name, such as TargetUsername, SrcIpAddr, or EventStartTime.

From

String

No*

(empty)

An expression that extracts the value from the source log, such as body["EventData"]["TargetUserName"].

Default

Any

No*

(empty)

A static value used when the source field is absent or the From expression returns nil.

* Provide at least one of From or Default for each row.

Examples

Map Windows logon events to ASIM Authentication

This mapping routes successful Windows Security Event ID 4624 records to ASimAuthenticationEventLogs. The Filter limits the mapping to successful logons. The field mappings set the common required ASIM columns with defaults and pull the Authentication-specific columns from the source body.

The processor rewrites the body to the ASIM Authentication columns, sets EventSchema to Authentication, preserves the original body under AdditionalFields, and sets the sentinel_stream_name attribute to Custom-ASimAuthenticationEventLogs. Microsoft Sentinel adds TimeGenerated at ingest time.

Configuration Tips

  • The first mapping whose Filter matches is applied, so order mappings from most to least specific. A mapping with no Filter matches everything and should be last.

  • Records that do not match any mapping are dropped, which keeps untransformed data out of native ASIM tables.

  • Disable Runtime Validation while building mappings, then re-enable it once the output is confirmed so records sent to Microsoft Sentinel are ASIM-compliant.

  • Numeric epoch values are not accepted for datetime columns because the unit is ambiguous. Convert epoch values to an RFC3339 string upstream before mapping them.

Troubleshooting

All records are dropped

Symptoms: no records reach Microsoft Sentinel after the processor runs.

Solutions:

  1. Confirm at least one mapping's Filter matches the incoming logs, or add a mapping with no Filter to catch the remainder. Unmatched records are dropped.

  2. With Runtime Validation enabled, confirm every ASIM common mandatory column has a From or Default. Records missing a required column are dropped.

A mapped field is missing on the output

Symptoms: a column you mapped does not appear, or the value differs from the source.

Solutions:

  1. Check that the From expression resolves on the source record. When it returns nil and no Default is set, the column is left unpopulated.

  2. Confirm the source value can be coerced to the target ASIM column type. Values that cannot be coerced are dropped with a warning, and the whole record is dropped if the column is required and Runtime Validation is enabled.

Records reach Sentinel but land in the wrong table

Symptoms: data arrives in Microsoft Sentinel under an unexpected ASIM table.

Solutions:

  1. Verify the Target Table on the matching mapping. The processor derives sentinel_stream_name as Custom-<TargetTable>.

  2. Confirm the Microsoft Sentinel destination is in ASIM mode so it routes on sentinel_stream_name.

Standalone Processor

Last updated

Was this helpful?