The Advanced SIEM Information Model (ASIM): Now Built into Microsoft Sentinel

Wednesday, March 9, 2022 | 08:00AM - 9:00AM (PST, Redmond Time)
Microsoft Sentinel Webinar | The Advanced SIEM Information Model (ASIM): Now Built into Microsoft Sentinel
Presenter(s): Ofer Shezaf
Description:
Working with multiple data types and sources is a challenge: Understanding different schemas and creating a unique set of analytics rules, workbooks, and hunting queries for each data source. Now that ASIM is built into Microsoft Sentinel, we will show you how to best use ASIM to use Microsoft Sentinel without worrying about each source's details. Use queries across all your data sources and write simpler and more robust analytic rules and hunting queries.
Advanced Security Information Model (ASIM) security content: docs.microsoft.com/en-us/azur...
To ensure you hear about future Microsoft Sentinel webinars and other developments, make sure you join our community by going to aka.ms/SecurityCommunity
#MicrosoftSentinel #ASIM #Normalization

[@georgeollis]

This was a super helpful video. Great benefits!

[@stubstunner]

Does ASIM come enabled or do I have to do something special to search the ASIM tables?

[@MicrosoftSecurityCommunity]

Hi Dan, please direct your questions directly to Microsoft Sentinel forum at aka.ms/MicrosoftSentinelCommunity. Someone from our engineering team will get back to you. Thank you for watching!

[@rafaelruales6871]

it looks like they have deployed already information model parsers to LA workspaces, you should be able to search them