ASIM Parser Filter Validator

Validates that an ASIM parser's filtering parameters (e.g. disabled, starttime, endtime, srcipaddr_has_any_prefix, etc.) behave correctly by running queries against a Log Analytics workspace.

This skill is a pure PowerShell implementation that uses az CLI for authentication. No Python, Azure SDK packages, or YAML modules are required.

• PowerShell 7+
• Azure CLI (logged in via az login)

What it tests

For every filtering parameter declared in the parser's KQL function signature:

Supported schemas

AgentEvent, AlertEvent, AssetEntity, AuditEvent, Authentication, DhcpEvent, Dns, FileEvent, NetworkSession, ProcessEvent, RegistryEvent, UserManagement, WebSession.

Inputs

How to run

.\scripts\asimFilterTest.ps1 -ParserFile "{PathToFilterParserKQL}" -SchemaName "{SchemaName}" -WorkspaceId "{your-workspace-guid}"

Prerequisites

1. Azure CLI authenticated — run az login if not already logged in. If you get an authentication error, use the az-cli-command-runner skill to verify login status.
2. The workspace must contain data for the tables referenced by the parser.

Interpreting results

• Green — test passed.
• FAIL — the filtering parameter did not behave as expected. The failure message indicates which parameter failed and what was expected.
• Known partial validations — AuditEvent (EventResult), Authentication (EventType), and Dns (EventType) have known single-failure scenarios that are automatically ignored.

Known acceptable failure reasons (can be ignored)

When analyzing filter-validation failures, a failure can be ignored if it matches one of these inherent-limitation categories:

1. Documented schema known exception — The schema defines a known exception for a parameter (e.g. a multi-value test that cannot succeed because the value combinations do not co-exist in that schema's data). Check whether the ASIM schema documentation lists the parameter as a known exception.
2. Constant or single-value field by design — The parser maps the filtered field to a single constant value, so multi-value or reduction-based filtering cannot reduce rows further. This is expected when the source provides only one possible value for that field.
3. Insufficient distinct values in the test window — The 2-day query window does not contain enough distinct values for the field to exercise multi-value filtering. This is a data-availability limitation, not a parser bug.

When reviewing filter-validation output, analyze each failure message against these categories. If all other parameters pass and every failure maps to one of the reasons above, the parser's filtering implementation is considered correct.

Troubleshooting