Skip to content

Commit a112e4b

Browse files
authored
Merge pull request #313029 from yummyblabla/derricklee/add-entity-refs
[ASIM] Clarify entity schemas in doc
2 parents 7082e76 + 16c09c3 commit a112e4b

2 files changed

Lines changed: 9 additions & 4 deletions

File tree

articles/sentinel/TOC.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -974,6 +974,8 @@
974974
href: normalization-known-issues.md
975975
- name: ASIM entities
976976
items:
977+
- name: ASIM asset entity schema
978+
href: normalization-schema-asset.md
977979
- name: ASIM user entity
978980
href: normalization-entity-user.md
979981
- name: ASIM device entity
@@ -984,16 +986,14 @@
984986
items:
985987
- name: ASIM alert event schema
986988
href: normalization-schema-alert.md
987-
- name: ASIM asset entity schema
988-
href: normalization-schema-asset.md
989989
- name: ASIM audit event schema
990990
href: normalization-schema-audit.md
991991
- name: ASIM authentication schema
992992
href: normalization-schema-authentication.md
993-
- name: ASIM DNS schema
994-
href: normalization-schema-dns.md
995993
- name: ASIM DHCP schema
996994
href: normalization-schema-dhcp.md
995+
- name: ASIM DNS schema
996+
href: normalization-schema-dns.md
997997
- name: ASIM file event schema
998998
href: normalization-schema-file-event.md
999999
- name: ASIM network session schema

articles/sentinel/normalization-about-schemas.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ ASIM currently defines the following schemas for entities:
4343
| ------ | --------------------- | ------- | ------ |
4444
| [Asset Entity](normalization-schema-asset.md) | `AssetEntity` | 0.1.0 | GA |
4545

46+
For entities which are part of other ASIM schemas, refer to [Event Entities](#event-entities).
47+
4648
## Field naming
4749

4850
At the core of each schema are its field names. Field names belong to the following groups:
@@ -86,6 +88,9 @@ For more information about specific entity types, refer to:
8688
- [Device Entity](normalization-entity-device.md)
8789
- [Application Entity](normalization-entity-application.md)
8890

91+
For more information about full entity schemas, refer to:
92+
- [Asset Entity Schema](normalization-schema-asset.md)
93+
8994
## Aliases
9095

9196
Aliases allow multiple names for a specified value. In some cases, different users expect a field to have different names. For example, in DNS terminology, you might expect a field named [DnsQuery](normalization-schema-dns.md#query), while more generally, it holds a domain name. The alias [Domain](normalization-schema-dns.md#domain) helps the user by allowing the use of both names.

0 commit comments

Comments
 (0)