Creating high-quality ASIM parsers has always required deep knowledge about source data and ASIM schemas, careful KQL design, and repeated validation cycles. That process is meaningful to understand the whole Sentinel ecosystem, but it can be slow when you are starting from raw source data and trying to get to a production-ready parser.
Today, we are introducing a new agentic experience available now as open source that helps security teams move faster: an AI-guided workflow for creating ASIM parsers end to end.
Why this matters
ASIM parsers are the normalization layer that makes detections, hunting, and analytics portable across data sources. They are foundational, but building them involves many steps:
- Gathering source requirements and schema targets
- Authoring a parameter-less and a parameterized ASIM parser
- Validating schema conformance and data quality
- Packaging the parsers into a GitHub pull request for open-source contributions
ASIM normalization is important because it gives security teams a common language across different products and log formats. Without normalization, every detection, hunting query, and workbook has to be rewritten per vendor table, which increases engineering effort and creates blind spots when data sources change. With ASIM, the same analytic logic can operate across multiple sources through consistent field names and semantics.
This directly improves security outcomes by enabling faster content reuse, easier cross-source correlation, and more reliable incident triage. It also reduces long-term maintenance costs, because teams update parsers at the query and mapping layer instead of rewriting detection content each time a connector changes.
The new agentic experience orchestrates those steps for you with clear checkpoints and repeatable outputs.
What is the ASIM parser creation agentic experience?
The experience is built around a specialized set of skills that work together as a workflow. Instead of using a single prompt and hoping for the best, the agent walks through parser creation as a structured process.
At the center is the orchestration skill that coordinates:
- Requirement collection
- Parser generation
- Validation loops that test the parser schema and data outputs
- Optional deployment to Log Analytics and PR packaging for Azure-Sentinel
Where can I find these skills?
If you have cloned or forked the Azure-Sentinel repository, the skills are already there! All you need is GitHub Copilot CLI to get started. For more information, you can visit the README or our Learn Docs.
Another way to access these skills is through our Microsoft Sentinel Visual Studio Code Extension. You can simply chat with GitHub Copilot with your intention to create ASIM parsers, and it will call its loaded skills.
What you can expect in practice
When you start with a request like "Create a new ASIM parser for my source table" the agent can:
- Gather critical inputs
- Build the initial ASIM parser from source requirements
- Run schema and data validation
- Refine the parser in a loop until error-level findings are resolved (or report remaining blockers)
- Build the matching parameterized parser and re-validate
- Help deploy or package your parsers into a PR to contribute to open-source
Where this helps most
This workflow is especially useful when:
- Data is already flowing into Sentinel, but there are no supporting ASIM parsers yet
- Migrating legacy parsing logic to ASIM conventions
- Creating a parser needs to happen with almost no delay, without sacrificing validation confidence
It will also reduce onboarding time for analysts who are new to ASIM but comfortable with KQL and Sentinel operations.
Closing
The ASIM parser creation agentic experience is not about replacing engineering judgment. It is about amplifying it.
If you are building ASIM parsers today, now is the right time to pilot an agentic workflow and shape what comes next.
If you are new to ASIM, getting started with parsers is easier than ever. The guided agentic flow walks you through requirements, parser generation, and validation step by step, so you can learn the ASIM model while still producing useful, high-quality parser outputs quickly.
Microsoft