How to Redeploy ASIM for Microsoft Sentinel – Azure Cloud & AI Domain Blog (azurecloudai.blog)
I’ve not personally experienced the scenario, but have heard from others who have, but it’s possible that Advanced Security Information Model (ASIM) needs to be redeployed or removed.
When ASIM is deployed, a number of KQL functions are installed. These KQL functions provide the parsing intelligence and are important for ASIM to work in normalizing data.