Forum Discussion

admiramon's avatar
admiramon
Copper Contributor
Nov 10, 2022

ASIM disabled parser watchlist configuration

I am trying to disable source agnostic parsers via watchlist. There are two fields in the ASimDisabledParsers watchlist, "CallerContext" and "SourceSpecificParser".

 

I have tried a combination of the terms "ExcludeASimAuthenticationSigninLogs" and "ASimAuthenticationSignInLogs" in both/either fields and the source-agnostic parser still includes the SigninLogs parser in the query results.

 

Any example of how to fill in the watchlist to correctly disable parsers when using the source-agnostic parser function?

No RepliesBe the first to reply

Resources