You have a Microsoft Sentinel workspace. You need to prevent a built-in Advance Security information Model (ASIM) parse from being updated…

Microsoft Sentinel automatically updates built-in ASIM parsers deployed from solutions. To prevent these updates and maintain a specific version, you must create a workspace-deployed (custom) parser. There are two primary methods to achieve this:

1. Override the built-in parser: Redeploy the parser using its ARM template from the Microsoft Sentinel GitHub repository. This creates a workspace-deployed function with the same name as the built-in parser. This custom version takes precedence over the built-in one and will not be automatically updated by Microsoft.

2. Create a new custom parser: Build a new custom parser (e.g., a unifying parser) and copy the code from the built-in parser into it. This new parser is entirely managed by you and will not be updated. You would then reference this new custom parser in your analytics rules and hunting queries.

B. Creating a hunting query that references a built-in parser only uses the parser; it does not alter its management or prevent it from being automatically updated.

C. While redeploying is a correct action, specifying a parameter that identifies the context as built-in would likely contradict the goal of creating a custom, non-updatable parser.

E. Creating an analytics rule that uses a built-in parser does not prevent the parser from being updated. The rule will simply use the updated version after a new one is deployed.

1. Microsoft Documentation - Manage ASIM parsers: "Workspace-deployed parsers are part of your workspace and can be modified or created by you. Workspace-deployed parsers override built-in parsers with the same name... To prevent automatic updates for built-in parsers

create a workspace parser with the same name as the built-in parser you want to protect."

Source: Microsoft Learn

Manage ASIM parsers

Section: "Parser types".

2. Microsoft Documentation - Customize an ASIM parser: "To customize a parser

create a new workspace parser with the same name as the built-in parser you want to customize... The new

customized parser will override the built-in one... To start

copy the code of the built-in parser you want to customize. You can find the code for built-in parsers in the Microsoft Sentinel GitHub repository."

Source: Microsoft Learn

Customize an ASIM parser

Section: "Customize a parser".

3. Microsoft Sentinel GitHub Repository - ASIM Parsers: This repository contains the ARM templates used to deploy ASIM parsers as workspace-level functions. Deploying a parser using its template is a standard method for creating a workspace-deployed version.

Source: GitHub

Azure/Azure-Sentinel

Parsers/ASIM.