Ofer -
How can we maintain these ASIM parsers going forward? It looks like these are under active development, so when they change, how do we make sure we get all the new updates installed as soon as possible after release? When they are updated, do we just click the associated 'Deploy to Azure' buttons again? Is there a way to track what versions of each parser are currently installed? And when these are eventually incorporated into the standard Sentinel install (as I assume is the intent) will the new code transparently overwrite what we had previously installed from GitHub? Also, I see that there are a variety of rule templates in Sentinel that already depend on these (which is actually where I heard about ASIM in the first place). As new templates are added, will there be some kind of reference to the required version of the associated parsers?
Microsoft