You have a Microsoft Sentinel workspace named Workspace1. You need to exclude a built-in, source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser. What…

The correct answer is A. a watch list. To support excluding built-in source-specific parsers, ASIM uses a watchlist. https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers#set-up-your-

Submitted by satoshi_tk· Apr 18, 2026Configure your environment in Microsoft Sentinel

Question

You have a Microsoft Sentinel workspace named Workspace1. You need to exclude a built-in, source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser. What should you create in Workspace1?

Options

Aa watch list
Ban analytic rule
Ca hunting query
Da workbook

How the community answered

(42 responses)

A
83% (35)
B
10% (4)
C
5% (2)
D
2% (1)

Explanation

To support excluding built-in source-specific parsers, ASIM uses a watchlist. https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers#set-up-your-

Topics

#Microsoft Sentinel#ASIM#Watchlists#ASIM Parser Management

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice