You have a Microsoft Sentinel workspace named Workspace1 and 200 custom Advanced Security Information Model (ASIM) parsers based on the DNS schema. You need to make the 200 parses available in…

The correct answer is D. Create a YAML file based on the DNS template. Microsoft Sentinel's ASIM framework uses YAML files as the standard format for defining and deploying parsers. To efficiently deploy 200 custom parsers to a workspace, you first create a YAML file based on the appropriate schema template (DNS in this case), which can define…

Submitted by tarun92· Apr 18, 2026Configure your environment in Microsoft Sentinel

Question

You have a Microsoft Sentinel workspace named Workspace1 and 200 custom Advanced Security Information Model (ASIM) parsers based on the DNS schema. You need to make the 200 parses available in Workspace1. The solution must minimize administrative effort. What should you do first?

Options

ACopy the parsers to the Azure Monitor Logs page.
BCreate a JSON file based on the DNS template.
CCreate an XML file based on the DNS template.
DCreate a YAML file based on the DNS template.

How the community answered

(38 responses)

A
3% (1)
B
13% (5)
C
5% (2)
D
79% (30)

Explanation

Microsoft Sentinel's ASIM framework uses YAML files as the standard format for defining and deploying parsers. To efficiently deploy 200 custom parsers to a workspace, you first create a YAML file based on the appropriate schema template (DNS in this case), which can define multiple parsers and be deployed via an ARM template or directly through the Sentinel REST API - minimizing effort compared to deploying each parser individually. JSON (B) and XML (C) are not the formats used for ASIM parser definitions. Copying parsers to the Azure Monitor Logs page (A) is not a valid deployment method for ASIM parsers.

Topics

#Microsoft Sentinel#ASIM parsers#Deployment#Automation

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice