Advanced Security Information Model (ASIM) known issues

The following are the Advanced Security Information Model (ASIM) known issues and limitations:

Sentinel data lake

ASIM query time parsers are not supported for lake explorer and KQL jobs.

Performance challenges

ASIM based queries over a long time range, and which don't use filtering parameters, may be slow. Parsing is a resource-intensive operation, and when applied to a large, unfiltered, dataset, it's expected to be slow.

If you encounter performance issues:

• When using an interactive query, make sure to set the time picker to time range needed.
• Use parser filters. Most importantly use the starttime and the endtime filter parameters.

The ingest_time() function isn't supported

The ingest_time() function reports the time at which a record was ingested into Microsoft Sentinel, which may be different from TimeGenerated. This information is commonly used in queries that take into account ingestion delays. The ingest_time() has to be used in the context of a specific table and doesn't work with ASIM functions, which unify many different tables.

Misleading informational message

In some cases when using ASIM parser functions, usually when there are no results to the query, the following information message is displayed.

While the message is alarming, it's informational only, and the system behaved as expected. ASIM functions combine data from many sources, regardless of whether they're available in your environment or not. The message suggests that some of the sources aren't available in your environment.

Related content

• Advanced Security Information Model (ASIM) overview
• Advanced Security Information Model (ASIM) schemas
• Advanced Security Information Model (ASIM) parsers
• Using the Advanced Security Information Model (ASIM)
• Modifying Microsoft Sentinel content to use the Advanced Security Information Model (ASIM) parsers
• Deep Dive Webinar on Microsoft Sentinel Normalizing Parsers and Normalized Content