I speak about Microsoft Sentinel, Defender XDR and Entra ID at community events and conferences. Want me at your meetup or conference? Reach out on LinkedIn.
- 20 October 2026
Normalize Once, Detect Everywhere: Inside Microsoft Sentinel's ASIM
Every data source speaks its own dialect. The Advanced Security Information Model (ASIM) gives Microsoft Sentinel one schema to rule them all: write a detection once and let parsers do the translation. We look at how ASIM parsers work under the hood, where performance bites, and how to build custom parsers for sources Microsoft doesn't ship.
Microsoft SentinelASIMKQLDetection Engineering