Skip to content

Commit c6d94b5

Browse files
author
Goos
authored
Fixed a typo
1 parent 2bc8dad commit c6d94b5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/sentinel/normalization-develop-parsers.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,7 @@ In many cases, the original value extracted needs to be normalized. For example,
203203

204204
Also, ensuring that parser output fields matches type defined in the schema is critical for parsers to work. For example, you may need to convert a string representing date and time to a datetime field. Functions such as `todatetime` and `tohex` are helpful in these cases.
205205

206-
For example, the original unique event ID may be sent as an integer, but ASIM requires the value to be a string, to ensure broad compatibility among data sources. Therefore, when assigning the source field use `extned` and `tostring` instead of `project-rename`:
206+
For example, the original unique event ID may be sent as an integer, but ASIM requires the value to be a string, to ensure broad compatibility among data sources. Therefore, when assigning the source field use `extend` and `tostring` instead of `project-rename`:
207207

208208
```KQL
209209
| extend EventOriginalUid = tostring(ReportId),
@@ -500,4 +500,4 @@ Learn more about the ASIM in general:
500500
- Watch the [Deep Dive Webinar on Microsoft Sentinel Normalizing Parsers and Normalized Content](https://www.youtube.com/watch?v=zaqblyjQW6k) or review the [slides](https://1drv.ms/b/s!AnEPjr8tHcNmjGtoRPQ2XYe3wQDz?e=R3dWeM)
501501
- [Advanced Security Information Model (ASIM) overview](normalization.md)
502502
- [Advanced Security Information Model (ASIM) schemas](normalization-about-schemas.md)
503-
- [Advanced Security Information Model (ASIM) content](normalization-content.md)
503+
- [Advanced Security Information Model (ASIM) content](normalization-content.md)

0 commit comments

Comments
 (0)