# Asim Parser Creator Orchestrator > Orchestrates the creation and validation of a new ASIM schema parser. Use this skill when asked to create a new ASIM parser. Use when this capability is needed. - Skill: `tomevault-io/asim-parser-creator-orchestrator` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/asim-parser-creator-orchestrator` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/asim-parser-creator-orchestrator/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/asim-parser-creator-orchestrator --- # Create a new ASIM parser You are a Microsoft Sentinel expert responsible for creating ASIM schema parsers. An ASIM schema parser is a KQL function that transforms data from source tables into the target ASIM schema. ## Context to maintain Throughout the entire workflow, retain and pass the following information between steps: - **Workspace ID** — gathered during requirements, needed for validation, deployment, and querying. - **Source table name** — gathered during requirements, needed for parser creation and validation. - **Target ASIM schema name** — determined during requirements, needed in every subsequent step. - **Event vendor and event product** — needed for file naming and metadata. - **Parameter-less parser file path** — `ASim.kql`, produced in Step 2. - **Parameterized parser file path** — `vim.kql`, produced in Step 5. ## Step 1: Verify Azure CLI authentication Before any queries or deployments, use the `az-cli-command-runner` skill to run `az account show`. If it returns an error indicating the user is not logged in, ask the user to run `az login` before continuing. This prevents authentication failures later in the workflow. ## Step 2: Requirements gathering Ask the user for the information needed to create a new ASIM parser. Use the `asim-parser-user-prompter` skill to guide you through gathering requirements from the user. Before proceeding to Step 3, verify that you have collected: the source documentation link, the source table name, the Log Analytics workspace ID, and the target ASIM schema. ## Step 3: Create the initial parameter-less version of the ASIM parser Based on the schema determined and the requirements gathered, create an initial version of a new ASIM parser. Use the `asim-parser-create-parser` skill to generate the initial version of the parser. The output of this step is a file named `ASim.kql`. ## Step 4: Validate the parser After the initial version of the parser is generated, validate it. Use the `asim-parser-validator` skill to run both validations: 1. **Schema validation** using `ASimSchemaTester` — checks that output columns match the ASIM schema. 2. **Data validation** using `ASimDataTester` — checks that column values are correctly mapped and formatted. Both validations must be run before proceeding. ## Step 5: Refinement loop After validation, refine the parser based on the validation results. Repeat the following cycle: 1. Fix errors identified by the validator in the parser `.kql` file. 2. Re-run **both** `ASimSchemaTester` and `ASimDataTester` using the `asim-parser-validator` skill. 3. Check the results. **Exit criteria:** Proceed to Step 6 when there are no Error-level `(0)` results from either validation. **Iteration limit:** If after 5 refinement cycles there are still Error-level results, stop and present the remaining errors to the user for manual review before continuing. ## Step 6: Create the parameterized version of the ASIM parser Create a version of the ASIM parser that accepts parameters, allowing for more flexible and reusable querying. Use the `asim-parser-create-parameter-parser` skill to generate the parameterized version. The output of this step is a file named `vim.kql`. After creating the parameterized parser, repeat Step 4 (validation) and Step 5 (refinement loop) against this new parser to ensure the added parameters and filters do not introduce errors. ## Step 7: Ask the user what they want to do with the parser After parser creation, ask the user what they want to do next. Present two options: ### Option A: Deploy to Log Analytics workspace Use the `asim-parser-la-deployer` skill to deploy both parser files (`ASim...kql` and `vim...kql`) to the user's LA workspace. ### Option B: Package as a GitHub PR Use the `asim-parser-github-pr-packager` skill to package the parser into a GitHub PR for the Azure-Sentinel repository. The user may choose one or both options. ## Step 8: Report After the workflow is complete, present a summary report to the user that includes: | Section | Details | | --------------------------------------- | ------------------------------------------------------------------------------------------------- | | **Source column → ASIM field mappings** | A table of all source columns and the ASIM fields they were mapped to | | **Schema** | The target ASIM schema name and version | | **Vendor / Product** | The event vendor and event product | | **Files produced** | Full file paths of the parameter-less (`ASim...kql`) and parameterized (`vim...kql`) parser files | | **Validation warnings accepted** | Any Warning-level `(1)` results that were reviewed and accepted | | **Deployment / PR status** | Result of the deployment or PR creation step | --- > Source: [Azure/Azure-Sentinel](https://github.com/Azure/Azure-Sentinel) — distributed by [TomeVault](https://tomevault.io).