You have a Microsoft Sentinel workspace. You need to prevent a built-in Advance Security information Model (ASIM) parse from being updated automatically. What are two ways to achieve this goal? Each…

Redeploying a built-in ASIM parser and specifying a CallerContext parameter (like `workspace`, or implicitly `any` in this context) converts it into a custom parser that resides in your workspace. Custom workspace parsers are not subject to automatic updates from Microsoft, allowing you to maintain a specific version or apply custom modifications without them being overwritten.

Creating a hunting query that references an ASIM parser consumes the parser's output but does not alter the parser's update mechanism or prevent it from being automatically updated.

Redeploying a built-in parser and explicitly setting the CallerContext parameter to `built-in` would likely retain its status as a built-in parser, or revert to default behavior, which means it would still be subject to automatic updates.

Building a custom unifying ASIM parser means it is entirely defined and managed within your Microsoft Sentinel workspace. Since it's a user-created artifact, it is inherently not a built-in parser, and thus Microsoft will not automatically update it, giving you full control over its logic and the versions of any underlying parsers it references.

An analytics rule uses ASIM parsers to detect threats and generate alerts but does not control the update behavior of the parsers themselves or modify their status as built-in or custom.