Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete−
Learning path 07 · Create detections and perform investigations using Microsoft Sentinel ↗

8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management

0%

Study focus

Detection and response

Build analytics rules, automate triage, run playbooks, and manage security incidents.

Analytics and content

Apply UEBA, ASIM, KQL, workbooks, Content Hub solutions, and repository-based deployment.

8 modules · 56 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

06Data normalization in Microsoft Sentinel0/8 units−
06

Module 6

Data normalization in Microsoft Sentinel

Focus: ASIM schemas and parsers, parameterized KQL, custom parsers, and DCR transformations.
0/8
01 / 08Introduction

Normalization maps vendor-specific schemas into a common semantic model so one detection, hunt, or workbook can operate across sources.

Official moduleASIM objectives
02 / 08Understand data normalization

ASIM defines schemas, fields, values, aliases, and parsers for domains such as authentication, network, DNS, process, file, and web activity. Source-specific parsers translate native tables; unifying parsers combine enabled sources.

Official lessonASIM architecture
03 / 08Use ASIM Parsers

Call an ASIM unifying parser like a KQL function and apply supported parameters early. Filtering within the parser is usually more efficient than filtering after all sources are unioned.

_Im_Authentication(starttime=ago(1d)) | where EventResult == "Failure" | summarize Attempts=count() by TargetUsername, SrcIpAddr
Official lessonQuery normalized data
04 / 08Understand parameterized KQL functions

Stored functions accept typed parameters and return tabular data. Use parameters for time, source, user, IP, or severity filters. Centralized logic improves reuse, but changes affect every dependent rule, workbook, and query.

Official lessonReusable KQL functions
05 / 08Create an ASIM Parser
  1. Select the schema and map native fields.
  2. Normalize values and types.
  3. Add filter parameters and metadata.
  4. Test representative, missing, and malformed records.
  5. Include the parser in the appropriate unifying parser.

Quality means semantic correctness, coverage, performance, and ASIM content compatibility.

Official lessonBuild a custom parser
06 / 08Configure Azure Monitor Data Collection Rules

DCR transformations use KQL at ingestion to filter, reshape, enrich, or route records. The query begins with source and must return columns compatible with the destination. Filtering can reduce cost, but discarded data cannot be recovered.

Official lessonIngestion transformations
07 / 08Module assessment

Review schemas, source and unifying parsers, normalized fields, parameterized functions, parser creation, DCR transformations, and permanent ingestion filtering.

Official assessmentNormalization knowledge check
08 / 08Summary and resources

ASIM makes content portable; parameterized parsers improve performance, and DCR transformations control data before workspace storage.

Official moduleSummary and resources
End of learning pathCreate detections and perform investigations using Microsoft Sentinel
↑