Listen to this Post
Introduction:
Security teams using Microsoft Azure Sentinel now have two additional log sources natively mapped to the Advanced Security Information Model (ASIM): Cisco Secure Endpoint (formerly AMP) as `ASimAlert` and VMware ESXi as ASimAuthentication. These ASIM parsers normalize heterogeneous logs into a unified schema, reducing detection engineering effort and improving cross-platform correlation. BlueVoyant collaborated with Microsoft to deliver these built-in parsers and deployable ARM templates, enabling SOC analysts to ingest and query endpoint alerts and hypervisor authentication events without custom parsing.
Learning Objectives:
- Deploy ASIM‑normalized parsers for Cisco Secure Endpoint and VMware ESXi in Azure Sentinel using ARM templates and YAML configurations.
- Query normalized security data using ASIM schema functions (e.g.,
imAuthentication,imAlert) for unified threat hunting. - Implement codeless connector framework (CCF) data connectors to streamline custom log ingestion for unsupported sources.
You Should Know:
1. Understanding ASIM and the New Log Sources
ASIM (Advanced Security Information Model) is Microsoft’s open‑source normalization layer that maps vendor‑specific fields to standard schemas like Authentication, Process, DNS, and Alert. With the new additions:
– Cisco Secure Endpoint (AMP) alerts now appear as `ASimAlert` schema – containing fields such as EventSeverity, AlertName, TargetProcess, and FileHash.
– VMware ESXi authentication logs (hostd/vmkernel auth events) are mapped to `ASimAuthentication` – including LogonType, Username, SrcIpAddr, and Result.
This means you can write one KQL query using `imAlert()` or `imAuthentication()` and automatically cover both raw and normalized data from these sources alongside others like Microsoft Defender or Okta.
Quick validation command (Azure CLI):
List installed ASIM parsers in your workspace az sentinel data-connector list --resource-group <RG> --workspace-name <Workspace> --output table
2. Deploying the ARM Templates (Step‑by‑Step)
BlueVoyant provided ARM templates to deploy the parsers automatically. Each template creates the necessary ASIM functions inside your Sentinel workspace.
Step‑by‑step guide for VMware ESXi ASIM Authentication parser:
- Download the ARM template from the provided link:
`https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/ARM/vimAuthenticationVMwareESXi/vimAuthenticationVMwareESXi.json`2. Deploy using Azure CLI:
az deployment group create --resource-group <YOUR_RG> \ --template-file vimAuthenticationVMwareESXi.json \ --parameters workspaceName=<YOUR_SENTINEL_WORKSPACE>
3. For Cisco Secure Endpoint ASIM Alert parser, use:
az deployment group create --resource-group <YOUR_RG> \ --template-file ciscoSecureEndpointAlert.json \ --parameters workspaceName=<YOUR_SENTINEL_WORKSPACE>
4. Alternatively, deploy via PowerShell:
New-AzResourceGroupDeployment -ResourceGroupName <RG> ` -TemplateFile ".\vimAuthenticationVMwareESXi.json" ` -workspaceName "<Workspace>"
- After deployment, verify the parser function exists in Log Analytics:
Run `Get-ASimParser.ps1` from Azure Sentinel GitHub repo or execute KQL:// Check for ESXi auth parser union vimAuthenticationVMwareESXi | take 10
-
Configuring Log Ingestion from Cisco Secure Endpoint and VMware ESXi
Before ASIM parsers work, you must send logs to Azure Sentinel. Use the Codeless Connector Framework (CCF) for custom sources, but for these two, Microsoft provides native connectors.
Cisco Secure Endpoint (AMP) via API:
- Use the “Cisco Secure Endpoint (AMP)” data connector in Sentinel.
- Prerequisites: API client ID and API key from Cisco Secure Endpoint portal.
- Configuration steps:
- In Sentinel, go to Data Connectors → Cisco Secure Endpoint (AMP) → Open connector page.
- Enter your API credentials and select the event types (Alerts, Detections, etc.).
- Click “Connect” – logs will flow into
CiscoSecureEndpoint_CL. - The ASIM parser will automatically map `CiscoSecureEndpoint_CL` to
imAlert().
VMware ESXi via Syslog:
- ESXi authentication logs are generated by hostd. Configure your ESXi host to send syslog to Azure Monitor Agent (AMA) or a Linux syslog‑ng forwarder.
- On the ESXi host (via SSH or DCUI):
esxcli system syslog config set --loghost='tcp://<YOUR_FORWARDER_IP>:514' esxcli system syslog reload
- On the syslog forwarder (Ubuntu example), install and configure rsyslog to forward to Log Analytics workspace:
sudo apt install rsyslog echo "auth. @<OMS_AGENT_IP>:25224" >> /etc/rsyslog.conf sudo systemctl restart rsyslog
- In Sentinel, use the “Syslog” data connector and map facility `auth` to the appropriate table (e.g.,
Syslog). The ASIM parser `vimAuthenticationVMwareESXi` will then normalize those entries.
4. Writing ASIM‑Based Queries for Unified Hunting
Once logs are ingested and parsers deployed, use the schema functions to query across all normalized sources.
Query 1: Detect brute‑force attempts on VMware ESXi (imAuthentication):
imAuthentication() | where Schema == "ASimAuthentication" | where EventProduct == "VMware ESXi" | where EventResult == "Failure" | summarize FailedLogons = count() by SrcIpAddr, TargetUsername, bin(TimeGenerated, 5m) | where FailedLogons > 10
Query 2: Correlate Cisco Secure Endpoint alerts with Windows process creation (imAlert + imProcess):
let CiscoAlerts = imAlert()
| where EventProduct == "Cisco Secure Endpoint"
| where AlertSeverity in ("High","Medium")
| project TimeGenerated, AlertName, TargetProcessName = tostring(AlertTarget["ProcessName"]), Hostname;
let Processes = imProcess()
| where ActingProcessName contains "powershell"
| project TimeGenerated, Hostname, ProcessCommandLine;
CiscoAlerts | join Processes on Hostname, $left.TimeGenerated between (Processes.TimeGenerated - 5m .. Processes.TimeGenerated + 5m)
- Enhancing Detection with Custom ASIM Parsers (Codeless Connector Framework)
To extend ASIM to other unsupported sources, use the Codeless Connector Framework (CCF). Create a YAML parser that maps your custom logs to ASIM fields.
Example YAML snippet for a hypothetical firewall log (ASimNetworkSession):
name: MyFirewallASimParser schema: ASimNetworkSession connectorType: Custom dataSource: sourceType: Syslog mappings: - fieldName: SrcIpAddr source: raw.source_ip - fieldName: DstIpAddr source: raw.dest_ip - fieldName: EventResult source: raw.action valueMap: allow: Success deny: Failure
Deploy it using Azure CLI:
az sentinel data-connector create --kind "Custom" --workspace-name <Workspace> --parser-yaml @myparser.yaml
6. Validating ASIM Parser Installation and Performance
After deployment, run these validation steps to ensure parsers work as expected.
Check parser function existence (KQL):
search | where $table has "vimAuthenticationVMwareESXi" | distinct $table
Measure performance – compare raw vs normalized query execution:
// Raw table query (slower, requires field mapping knowledge) CiscoSecureEndpoint_CL | where TimeGenerated > ago(1h) | count // ASIM query (faster due to optimized functions, but test) imAlert() | where TimeGenerated > ago(1h) | where EventProduct == "Cisco Secure Endpoint" | count
Troubleshooting missing data:
- Verify data connector health in Sentinel → Logs → “Data collection diagnostics”.
- For Cisco AMP, check API quotas – free tier may limit poll frequency.
- For VMware ESXi, confirm syslog reachability:
From Windows Test-NetConnection -ComputerName <ESXi_IP> -Port 514
7. Maintaining and Updating ASIM Parsers
Microsoft and BlueVoyant will continue updating these parsers via the Azure-Sentinel GitHub repository. To stay current:
- Subscribe to the repository: `https://github.com/Azure/Azure-Sentinel`
- Use Azure Policy to enforce latest parser versions across your environment.
- Automate redeployment with a DevOps pipeline (example Azure DevOps YAML):
trigger: none pool: vmImage: ubuntu-latest steps:</li> <li>script: | az deployment group create --resource-group $(RG) \ --template-file ./Parsers/ASimAuthentication/ARM/vimAuthenticationVMwareESXi/latest.json \ --parameters workspaceName=$(Workspace) displayName: 'Deploy latest ESXi ASIM parser'
What Undercode Say:
- ASIM is not just a parser – it’s a strategy. Organizations adopting ASIM reduce detection engineering effort by 40‑60% according to Microsoft’s internal telemetry. The Cisco and VMware additions close critical gaps in hybrid cloud visibility.
- Deployment is easy, but maintenance requires automation. The provided ARM templates are one‑click, but version drift between raw logs and ASIM functions will happen. Integrate GitHub as a continuous source of truth for parser updates.
Analysis: BlueVoyant’s contribution signals a shift toward vendor‑collaborative normalization. For SOC teams, this means fewer “custom parsers” to maintain and more time hunting. The real power comes when you combine `imAuthentication` with UEBA or when `imAlert` feeds into automation rules – a future where every log source speaks the same language.
Prediction:
Within 12 months, Microsoft will release a “Universal ASIM Connector” that auto‑detects log schemas and generates YAML parsers using AI (GPT‑4 class). This will drop the barrier to entry for mid‑size enterprises, but advanced teams will still need manual tuning for obscure appliances. The Cisco and VMware ASIM support announced today is a stepping stone to a fully normalized, codeless future – expect similar announcements for Palo Alto, AWS CloudTrail, and Kubernetes audit logs by Q4 2026.
▶️ Related Video (62% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Steve Miller – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
