You have a Microsoft Sentinel workspace. You need to create a parameter-less custom parser for an authentication information model. Which syntax should you use? ASimAuthentication ASiAuthentication<vendor><Product> imAuthentication vimAuthentication<vendor><Product>

To create a parameter-less custom parser for an authentication information model in your Microsoft Sentinel workspace, you should use the following syntax for naming your KQL function: ASimAuthentication [2]. The other provided options (ASiAuthentication, imAuthentication, and vimAuthentication) are not the correct naming conventions for this type of parser.

References

Any other questions?