Skip to content

[ASIM] Fix _Im_ProcessEvent parameters#13932

Merged
yummyblabla merged 7 commits into
masterfrom
derricklee/asim-fix-processevent-parameters
Apr 17, 2026
Merged

[ASIM] Fix _Im_ProcessEvent parameters#13932
yummyblabla merged 7 commits into
masterfrom
derricklee/asim-fix-processevent-parameters

Conversation

@yummyblabla
Copy link
Copy Markdown
Collaborator

Parameters for Im_ProcessEvent in functions are not consistent with documentation.

Old parsers are using:

  • targetusername
  • actorusername
  • dvcname_has_any

All filtering parsers are now using parameter names from documentation:
https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-process-event#filtering-parser-parameters

  • targetusername_has
  • actorusername_has
  • dvchostname_has_any

@yummyblabla yummyblabla requested review from a team as code owners March 27, 2026 22:42
@contentautomationbot
Copy link
Copy Markdown

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

@yummyblabla yummyblabla merged commit d2eadee into master Apr 17, 2026
33 of 35 checks passed
@yummyblabla yummyblabla deleted the derricklee/asim-fix-processevent-parameters branch April 17, 2026 23:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants