In Microsoft Sentinel , Advanced Security Information Model (ASIM) parsers normalize different data types for analytics. Built-in parsers update automatically when Microsoft releases improvements. However, you can prevent automatic updates by redeploying or overriding them.
Per Microsoft Sentinel ASIM documentation:
* You can redeploy a built-in parser with custom parameters ( CallerContext=any , SourceSpecificParse=any ) to create a local copy. This local redeployment is treated as a custom parser and will not be automatically updated .
* Alternatively, you can build a custom unify parser that references a specific parser version. Custom parsers are user-managed and unaffected by ASIM's automated update pipeline.
Other options (like creating hunting queries or analytics rules) merely reference the parser and do not affect its update behavior.
# Correct answers: A and D