Advanced Security Information Model (ASIM) schemas

An Advanced Security Information Model (ASIM) schema is a set of fields that represent an activity. Using the fields from a normalized schema in a query ensures that the query will work with every normalized source.

To understand how schemas fit within the ASIM architecture, refer to the ASIM architecture diagram.

Schema references outline the fields that comprise each schema. ASIM currently defines the following schemas:

Schema concepts

The following concepts help to understand the schema reference documents and extend the schema in a normalized manner in case your data includes information that the schema doesn't cover.

Field naming

At the core of each schema are its field names. Field names belong to the following groups:

• Fields common to all schemas.
• Fields specific to a schema.
• Fields that represent entities, such as users, which take part in the schema. Fields that represent entities are similar across schemas.

When sources have fields that aren't presented in the documented schema, they're normalized to maintain consistency. If the extra fields represent an entity, they'll be normalized based on the entity field guidelines. Otherwise, the schemas strive to keep consistency across all schemas.

For example, while DNS server activity logs don't provide user information, DNS activity logs from an endpoint might include user information, which can be normalized according to the user entity guidelines. |

Field logical types

Each schema field has a type. The Log Analytics workspace has a limited set of data types. For this reason, Microsoft Sentinel uses a logical type for many schema fields, which Log Analytics doesn't enforce but is required for schema compatibility. Logical field types ensure that both values and field names are consistent across sources.

For more information, see Logical types.

Field classes

Fields might have several classes, which define when the fields should be implemented by a parser:

• Mandatory fields must appear in every parser. If your source doesn't provide information for this value, or the data can't be otherwise added, it won't support most content items that reference the normalized schema.
• Recommended fields should be normalized if available. However, they might not be available in every source. Any content item that references that normalized schema should take availability into account.
• Optional fields, if available, can be normalized or left in their original form. Typically, a minimal parser wouldn't normalize them for performance reasons.
• Conditional fields are mandatory if the field they follow is populated. Conditional fields are typically used to describe the value in another field. For example, the common field DvcIdType describes the value int the common field DvcId and is therefore mandatory if the latter is populated.
• Alias is a special type of a conditional field, and is mandatory if the aliased field is populated.

Common fields

Some fields are common to all ASIM schemas. Each schema might add guidelines for using some of the common fields in the context of the specific schema. For example, permitted values for the EventType field might vary per schema, as might the value of the EventSchemaVersion field.

Entities

Events evolve around entities, such as users, hosts, processes, or files. Each entity might require several fields to describe it. For example, a host might have a name and an IP address.

A single record might include multiple entities of the same type, such as both a source and destination host.

ASIM defines how to describe entities consistently, and entities allow for extending the schemas.

For example, while the Network Session schema doesn't include process information, some event sources do provide process information that can be added. For more information, see Entities.

Aliases

Aliases allow multiple names for a specified value. In some cases, different users expect a field to have different names. For example, in DNS terminology, you might expect a field named DnsQuery, while more generally, it holds a domain name. The alias Domain helps the user by allowing the use of both names.

In some cases, an alias can have the value of one of several fields, depending on which values are available in the event. For example, the Dvc alias, aliases either the DvcFQDN, DvcId, DvcHostname, or DvcIpAddr , or Event Product fields. When an alias can have several values, its type has to be a string to accommodate all possible aliased values. As a result, when assigning a value to such an alias, make sure to convert the type to string using the KQL function tostring.

Native normalized tables do not include aliases, as those would imply duplicate data storage. Instead the stub parsers add the aliases. To implement aliases in parsers, create a copy of the original value by using the extend operator. |

Logical types

Each schema field has a type. Some have built-in, Log Analytics types, such as string, int, datetime, or dynamic. Other fields have a Logical type, which represents how the field values should be normalized.

Entities

Events evolve around entities, such as users, hosts, processes, or files. Entity representation allows several entities of the same type to be part of a single record, and support multiple attributes for the same entities.

To enable entity functionality, entity representation has the following guidelines:

For more information about specific entity types refer to:

• User Entity
• Device Entity

Sample entity mapping

This section uses Windows event 4624 as an example to describe how the event data is normalized for Microsoft Sentinel.

This event has the following entities:

Based on these entities, Windows event 4624 is normalized as follows (some fields are optional):

Next steps

This article provides an overview of normalization in Microsoft Sentinel and ASIM.

For more information, see:

• Watch the Deep Dive Webinar on Microsoft Sentinel Normalizing Parsers and Normalized Content or review the slides
• Advanced Security Information Model (ASIM) overview
• Advanced Security Information Model (ASIM) parsers
• Advanced Security Information Model (ASIM) content